Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 04:51

General

  • Target

    c4e7de71e86affcece70059ccbf8cff7.exe

  • Size

    473KB

  • MD5

    c4e7de71e86affcece70059ccbf8cff7

  • SHA1

    ea6cea75b55026c665ced20326ba0e777e6efd07

  • SHA256

    f6d0fcc214adc2d411aaf7142e0d05ca532eedf6ac4fb70d60753718c55e24e5

  • SHA512

    fac9ac9f8bc8d3a14eb677b47dcb570ba338de02283317bd4fdaf0b24ed923c79aa6ad9f4dbe3f1562fb4f3a67c49fdef8134dc04115f88f8afdc7557200739b

  • SSDEEP

    12288:eNpszYhvXWSVJdMaeaxxJGJ0k8rbYfyprRYKJdnxb:ihvJVJdMQeuk6Ygdx

Malware Config

Extracted

Family

redline

Botnet

@burduc

C2

45.81.227.32:22625

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e7de71e86affcece70059ccbf8cff7.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e7de71e86affcece70059ccbf8cff7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Roaming\JaNBM.exe
      "C:\Users\Admin\AppData\Roaming\JaNBM.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "{path}"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2716

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Roaming\JaNBM.exe

          Filesize

          201KB

          MD5

          4f9729fc5afca11b32fa7a3cb47fe5b3

          SHA1

          26bf2656ec4be0d077958342aa3efe6b50bcc02c

          SHA256

          5608760b7ffaf577f8ab79f59629789489cdc97d3cbc302669a1523eff699ef6

          SHA512

          dd958913997171661ba36f2ad97a44b1959e929b234b9c056b7d66be4404ef407e3c971160ad346c8979245d3785d43896bda46291bcdd038615f58db6896130

        • memory/1892-33-0x0000000074940000-0x000000007502E000-memory.dmp

          Filesize

          6.9MB

        • memory/1892-18-0x0000000000540000-0x0000000000546000-memory.dmp

          Filesize

          24KB

        • memory/1892-19-0x0000000000D70000-0x0000000000DB0000-memory.dmp

          Filesize

          256KB

        • memory/1892-21-0x0000000000550000-0x0000000000556000-memory.dmp

          Filesize

          24KB

        • memory/1892-20-0x00000000005B0000-0x00000000005DC000-memory.dmp

          Filesize

          176KB

        • memory/1892-17-0x0000000074940000-0x000000007502E000-memory.dmp

          Filesize

          6.9MB

        • memory/1892-22-0x0000000000560000-0x000000000056C000-memory.dmp

          Filesize

          48KB

        • memory/1892-16-0x0000000001080000-0x00000000010BC000-memory.dmp

          Filesize

          240KB

        • memory/2716-29-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/2716-26-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-34-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-31-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-25-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-35-0x0000000074940000-0x000000007502E000-memory.dmp

          Filesize

          6.9MB

        • memory/2716-24-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-23-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2716-36-0x0000000004B10000-0x0000000004B50000-memory.dmp

          Filesize

          256KB

        • memory/2716-37-0x0000000074940000-0x000000007502E000-memory.dmp

          Filesize

          6.9MB

        • memory/2716-38-0x0000000004B10000-0x0000000004B50000-memory.dmp

          Filesize

          256KB