redline | 14d7d6125f2bce6ecb7ecc0f20f47562f4aab1da54bc35e2718b942646e7aecc

Resubmissions

07-01-2024 13:17

240107-qjrhxsgbdp 10

Analysis

max time kernel
197s
max time network
207s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Magtek-I380 MAGNETIC CREDIT CARDS2021.exe
Size

18.3MB
MD5

fbde172b90ea19acabf815e3c433edaa
SHA1

91a4cf027936cc663104b30535f00536cabb72cc
SHA256

14d7d6125f2bce6ecb7ecc0f20f47562f4aab1da54bc35e2718b942646e7aecc
SHA512

bb4390616844ffca2c33cf47494bdbfd83010b30fe612f549c9d49c4b01ecb143f2607038639bfc0ca124068fa09d143964f53f634e09c56a8c64f58ed20b339
SSDEEP

393216:wXxhXM/bH/2hCOeW9paqMbfIHd183HOpj6l8+i8bEoQZ/85ABvyWfhXTR:wBhgbHQCO/w7IHd18XOpj6l8N8b5QZ/R

Score

10^/10

redline sectoprat black infostealer rat trojan

Malware Config

Extracted

Family

redline

Botnet

black

213.136.85.189:51682

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021\Unziped.exe	family_redline
behavioral1/memory/2004-24-0x0000000000BD0000-0x0000000000BF8000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021\Unziped.exe	family_sectoprat
behavioral1/memory/2004-24-0x0000000000BD0000-0x0000000000BF8000-memory.dmp	family_sectoprat

Executes dropped EXE 1 IoCs

Processes:

Unziped.exe

pid process

2004 Unziped.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2004	Unziped.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

pid process

2956 Magtek-I380 MAGNETIC CREDIT CARDS2021.exe
2956 Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

pid	process
2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe
2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Magtek-I380 MAGNETIC CREDIT CARDS2021.exe

description	pid	process	target process
PID 2956 wrote to memory of 2004	2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe	Unziped.exe
PID 2956 wrote to memory of 2004	2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe	Unziped.exe
PID 2956 wrote to memory of 2004	2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe	Unziped.exe
PID 2956 wrote to memory of 2004	2956	Magtek-I380 MAGNETIC CREDIT CARDS2021.exe	Unziped.exe

C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021.exe
"C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021\Unziped.exe
"C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021\Unziped.exe"
2⤵
- Executes dropped EXE
PID:2004

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2500

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Magtek-I380 MAGNETIC CREDIT CARDS2021\Unziped.exe
Filesize
142KB

MD5
7a894207b325e306af5b0a3b8e75dfe1

SHA1
35061211da531995d198b825344b13f560a6d8a5

SHA256
840cb5293625623a2047af2635596db04bd08293c396881e1245f9af560c1bc1

SHA512
02cbee7cba38bf6e99b596fe12b9ed614fca6e6e8fa758a53298741707914231cc5d96e421384df8056ac55bc75a2c8ac380dfe4cd3d544f250ae060ead4188f

Download Submit
memory/2004-24-0x0000000000BD0000-0x0000000000BF8000-memory.dmp

Filesize
160KB

Download
memory/2004-25-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download
memory/2004-26-0x0000000004510000-0x0000000004550000-memory.dmp

Filesize
256KB

Download
memory/2004-27-0x00000000746D0000-0x0000000074DBE000-memory.dmp

Filesize
6.9MB

Download