Analysis

  • max time kernel
    159s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 04:51

General

  • Target

    c4e7de71e86affcece70059ccbf8cff7.exe

  • Size

    473KB

  • MD5

    c4e7de71e86affcece70059ccbf8cff7

  • SHA1

    ea6cea75b55026c665ced20326ba0e777e6efd07

  • SHA256

    f6d0fcc214adc2d411aaf7142e0d05ca532eedf6ac4fb70d60753718c55e24e5

  • SHA512

    fac9ac9f8bc8d3a14eb677b47dcb570ba338de02283317bd4fdaf0b24ed923c79aa6ad9f4dbe3f1562fb4f3a67c49fdef8134dc04115f88f8afdc7557200739b

  • SSDEEP

    12288:eNpszYhvXWSVJdMaeaxxJGJ0k8rbYfyprRYKJdnxb:ihvJVJdMQeuk6Ygdx

Malware Config

Extracted

Family

redline

Botnet

@burduc

C2

45.81.227.32:22625

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4e7de71e86affcece70059ccbf8cff7.exe
    "C:\Users\Admin\AppData\Local\Temp\c4e7de71e86affcece70059ccbf8cff7.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Users\Admin\AppData\Roaming\JaNBM.exe
      "C:\Users\Admin\AppData\Roaming\JaNBM.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        "{path}"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:380

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\JaNBM.exe

          Filesize

          201KB

          MD5

          4f9729fc5afca11b32fa7a3cb47fe5b3

          SHA1

          26bf2656ec4be0d077958342aa3efe6b50bcc02c

          SHA256

          5608760b7ffaf577f8ab79f59629789489cdc97d3cbc302669a1523eff699ef6

          SHA512

          dd958913997171661ba36f2ad97a44b1959e929b234b9c056b7d66be4404ef407e3c971160ad346c8979245d3785d43896bda46291bcdd038615f58db6896130

        • memory/380-27-0x0000000005570000-0x0000000005582000-memory.dmp

          Filesize

          72KB

        • memory/380-29-0x0000000005760000-0x0000000005770000-memory.dmp

          Filesize

          64KB

        • memory/380-33-0x0000000005760000-0x0000000005770000-memory.dmp

          Filesize

          64KB

        • memory/380-32-0x0000000074C40000-0x00000000753F0000-memory.dmp

          Filesize

          7.7MB

        • memory/380-31-0x00000000063C0000-0x00000000064CA000-memory.dmp

          Filesize

          1.0MB

        • memory/380-30-0x0000000005320000-0x000000000536C000-memory.dmp

          Filesize

          304KB

        • memory/380-25-0x00000000065D0000-0x0000000006BE8000-memory.dmp

          Filesize

          6.1MB

        • memory/380-28-0x0000000005890000-0x00000000058CC000-memory.dmp

          Filesize

          240KB

        • memory/380-20-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/380-22-0x0000000074C40000-0x00000000753F0000-memory.dmp

          Filesize

          7.7MB

        • memory/380-26-0x00000000055D0000-0x0000000005662000-memory.dmp

          Filesize

          584KB

        • memory/380-24-0x0000000005A00000-0x0000000005FA4000-memory.dmp

          Filesize

          5.6MB

        • memory/4340-23-0x0000000074C40000-0x00000000753F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4340-13-0x00000000005F0000-0x000000000062C000-memory.dmp

          Filesize

          240KB

        • memory/4340-12-0x0000000074C40000-0x00000000753F0000-memory.dmp

          Filesize

          7.7MB

        • memory/4340-19-0x000000000A9E0000-0x000000000AA7C000-memory.dmp

          Filesize

          624KB

        • memory/4340-18-0x00000000029C0000-0x00000000029CC000-memory.dmp

          Filesize

          48KB

        • memory/4340-17-0x0000000002970000-0x0000000002976000-memory.dmp

          Filesize

          24KB

        • memory/4340-16-0x0000000002C00000-0x0000000002C2C000-memory.dmp

          Filesize

          176KB

        • memory/4340-15-0x00000000050F0000-0x0000000005100000-memory.dmp

          Filesize

          64KB

        • memory/4340-14-0x0000000002BC0000-0x0000000002BC6000-memory.dmp

          Filesize

          24KB