Analysis
-
max time kernel
2s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
07-01-2024 18:35
General
-
Target
f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe
-
Size
5.5MB
-
MD5
0a313a73aac1905c6ef571c4e700554a
-
SHA1
7f2e2d4656ae4a5e6015c51184e19ef26510fb12
-
SHA256
f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be
-
SHA512
b8323f01a915c1e28d9926a07518c798546ab12aa8d8c1038c9f18973beab78fda972aaea1b7a0814b6c3efa0847ee2f89ccc3abfa8bcc239eb12a36a069b576
-
SSDEEP
98304:xorRBQQyUroZi+nTf55/2UJ70UsjVk+io3McLpN3SQXB/uz7h4sWsjFe5qx:xorR3rETfjB70Ush9io3MeDOl4sW8+qx
Score
10/10
Malware Config
Extracted
Family
vidar
Version
40.3
Botnet
706
C2
https://lenko349.tumblr.com/
Attributes
-
profile_id
706
Extracted
Family
redline
Botnet
pab777
C2
185.215.113.15:6043
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe"C:\Users\Admin\AppData\Local\Temp\f25e4213555bb2e557f66fb99d91a03972c1882ca8c2ac8748e25fc09798e2be.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS82B2FE16\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS82B2FE16\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exeC:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\setup_install.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1785e69fa9997.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed1785e69fa9997.exeWed1785e69fa9997.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed1723a697f7.exeWed1723a697f7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffApp2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed171b4c251d7.exeWed171b4c251d7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BMN6I.tmp\Wed1714d285085.tmp"C:\Users\Admin\AppData\Local\Temp\is-BMN6I.tmp\Wed1714d285085.tmp" /SL5="$201E4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed1714d285085.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17f15b7389c9ebf74.exeWed17f15b7389c9ebf74.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17dff1d3c799e.exeWed17dff1d3c799e.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed1714d285085.exeWed1714d285085.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17d4eac5c83e204dc.exeWed17d4eac5c83e204dc.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 9482⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17f6f9bbb339c2.exe"C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17f6f9bbb339c2.exe" -u1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed1744842952dc03a.exeWed1744842952dc03a.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS41B70E16\Wed17f6f9bbb339c2.exeWed17f6f9bbb339c2.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 4361⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1744842952dc03a.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed17dff1d3c799e.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed17f15b7389c9ebf74.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1714d285085.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed17d4eac5c83e204dc.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1723a697f7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed171b4c251d7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed17f6f9bbb339c2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\e6e22792e2586e.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
844KB
-
Filesize
1024KB
-
Filesize
29.8MB
-
Filesize
29.8MB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
104KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
152KB
-
Filesize
256KB
-
Filesize
192KB
-
Filesize
1024KB
-
Filesize
144KB
-
Filesize
25.6MB
-
Filesize
1024KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
176KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
128KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1.5MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
528KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
140KB
-
Filesize
96KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
5.7MB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
436KB