Analysis
- max time kernel
39s - max time network
163s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
11/01/2024, 20:14
General
- Target 545e929d4444c8b17f5a1f5a08efc088.exe
- Size 662KB
- Sample240111-y1cebsffbl
- SHA256 6508c95b3207397a7bae85d516d87267e8789428f06e743618310e1cddef6f4b
Malware Config
Extracted
-
redline
-
1853653057
-
185.250.206.122:43180
Signatures
- Detect ZGRat V1 34 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\545e929d4444c8b17f5a1f5a08efc088.exe"C:\Users\Admin\AppData\Local\Temp\545e929d4444c8b17f5a1f5a08efc088.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fwbaulzusfthqslt.vbs"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Azhidogqcciwkfbnfkbuild.exe"C:\Users\Admin\AppData\Local\Temp\Azhidogqcciwkfbnfkbuild.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"4⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp9C11.tmp.cmd""5⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /sc MINUTE /mo 1 /tn "MicrosoftApi" /tr "'C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"'6⤵
- Creates scheduled task(s)
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\545e929d4444c8b17f5a1f5a08efc088.exeC:\Users\Admin\AppData\Local\Temp\545e929d4444c8b17f5a1f5a08efc088.exe2⤵
-
-
C:\Windows\system32\timeout.exetimeout 41⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\taskeng.exetaskeng.exe {B58B3A9E-3A23-4FDF-8A13-C7E65A27D1A5} S-1-5-21-1268429524-3929314613-1992311491-1000:XBTLDBHN\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exeC:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Azhidogqcciwkfbnfkbuild.exe
Azhidogqcciwkfbnfkbuild.exe
Fwbaulzusfthqslt.vbs
tmp9C11.tmp.cmd
MicrosoftApi.exe
MicrosoftApi.exe
MicrosoftApi.exe
MicrosoftApi.exe
Azhidogqcciwkfbnfkbuild.exe
MicrosoftApi.exe
memory/1192-2441-0x000000013F940000-0x000000013F9E2000-memory.dmp
memory/1192-2442-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
memory/1192-2453-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
memory/1456-2443-0x0000000000DD0000-0x0000000000E10000-memory.dmp
memory/1456-2440-0x0000000074D20000-0x000000007540E000-memory.dmp
memory/1456-2439-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1456-2452-0x0000000074D20000-0x000000007540E000-memory.dmp
memory/1456-2455-0x0000000000DD0000-0x0000000000E10000-memory.dmp
memory/2036-70-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-68-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-60-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-58-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-56-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-52-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-50-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-48-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-46-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-44-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-38-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-36-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-24-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-22-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-20-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-19-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/2036-15-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-13-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-11-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-9-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-7-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-6-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-64-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-62-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-0-0x0000000000F40000-0x0000000000FEA000-memory.dmp
memory/2036-2435-0x0000000074DA0000-0x000000007548E000-memory.dmp
memory/2036-66-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-54-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-42-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-40-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-26-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-34-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-30-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-32-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-28-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-17-0x0000000008250000-0x000000000830F000-memory.dmp
memory/2036-1-0x0000000074DA0000-0x000000007548E000-memory.dmp
memory/2036-2-0x0000000000DC0000-0x0000000000E00000-memory.dmp
memory/2036-5-0x0000000008250000-0x0000000008316000-memory.dmp
memory/2036-4-0x0000000005E10000-0x0000000005EAC000-memory.dmp
memory/2036-3-0x0000000074DA0000-0x000000007548E000-memory.dmp
memory/2336-2464-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
memory/2336-2454-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp
memory/2336-2451-0x000000013F390000-0x000000013F432000-memory.dmp
memory/2716-2466-0x000000013FFC0000-0x0000000140062000-memory.dmp
memory/2716-2467-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp
memory/2716-2469-0x000000001D0F0000-0x000000001D170000-memory.dmp
memory/2716-2468-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp