Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 12:37

General

  • Target

    567b2021c7a3db81cfd1421d3d7d37a1.exe

  • Size

    978KB

  • MD5

    567b2021c7a3db81cfd1421d3d7d37a1

  • SHA1

    5b6e3b6c6840cc282f7458af24dc18ea03c44009

  • SHA256

    4a0d83439be8a28152984b5800a6a1882d95e5ac361ad24131a688237bf403b7

  • SHA512

    bcc4cf1230cd7f51a813c48b984dc152d19f53ad10f0621f36903a528d408d01e488021d8d8f5f392b95c82fa3236f2aa14db3d2ad4dd128cf2ccc028b460675

  • SSDEEP

    24576:tr065nEVHc2YRQCWnwO5BqGff8NfMuYETj5mWGYlyy/2zw:trpnRwwAfwMG5mWGYlyM2

Malware Config

Extracted

Family

redline

Botnet

@Cryptex777

C2

109.248.203.166:29888

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\567b2021c7a3db81cfd1421d3d7d37a1.exe
    "C:\Users\Admin\AppData\Local\Temp\567b2021c7a3db81cfd1421d3d7d37a1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Update\Update" /XML "C:\Users\Admin\AppData\Local\Temp\1221637971.xml"
      2⤵
      • Creates scheduled task(s)
      PID:848
    • C:\Users\Admin\AppData\Local\Temp\567b2021c7a3db81cfd1421d3d7d37a1.exe
      "C:\Users\Admin\AppData\Local\Temp\567b2021c7a3db81cfd1421d3d7d37a1.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Users\Admin\AppData\Local\Temp\._cache_567b2021c7a3db81cfd1421d3d7d37a1.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_567b2021c7a3db81cfd1421d3d7d37a1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1576

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1221637971.xml

          Filesize

          1KB

          MD5

          96d9b445e5ef478537dd07eb639374fa

          SHA1

          f10f497562fd6aa3e9788b40254c146316784415

          SHA256

          30513d1f58f1f4a23b66262710f670c92f493b571e862e9231ddf0181b91a186

          SHA512

          b07668478ae645220a72641e7f56f5f0f6a719d289e1dc0d8f1499c2e6041d28fdae57c8679e12ea70ba7e13b486e4aeb0a9ca5c12e27a85ae1126d20232a772

        • memory/1116-154-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/1116-144-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/1116-142-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/1116-155-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

          Filesize

          64KB

        • memory/1576-143-0x0000000000620000-0x000000000063E000-memory.dmp

          Filesize

          120KB

        • memory/1576-146-0x0000000005160000-0x00000000051F2000-memory.dmp

          Filesize

          584KB

        • memory/1576-145-0x0000000005670000-0x0000000005C14000-memory.dmp

          Filesize

          5.6MB

        • memory/1576-156-0x00000000721A0000-0x0000000072950000-memory.dmp

          Filesize

          7.7MB

        • memory/1576-157-0x00000000052B0000-0x00000000052C0000-memory.dmp

          Filesize

          64KB

        • memory/1576-153-0x00000000060C0000-0x00000000061CA000-memory.dmp

          Filesize

          1.0MB

        • memory/1576-152-0x0000000005F20000-0x0000000005F6C000-memory.dmp

          Filesize

          304KB

        • memory/1576-151-0x00000000052B0000-0x00000000052C0000-memory.dmp

          Filesize

          64KB

        • memory/1576-147-0x00000000721A0000-0x0000000072950000-memory.dmp

          Filesize

          7.7MB

        • memory/1576-148-0x0000000006240000-0x0000000006858000-memory.dmp

          Filesize

          6.1MB

        • memory/1576-149-0x0000000005200000-0x0000000005212000-memory.dmp

          Filesize

          72KB

        • memory/1576-150-0x0000000005D10000-0x0000000005D4C000-memory.dmp

          Filesize

          240KB

        • memory/2876-17-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/2876-1-0x00000000015B0000-0x00000000015C0000-memory.dmp

          Filesize

          64KB

        • memory/2876-2-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/2876-0-0x0000000074810000-0x0000000074DC1000-memory.dmp

          Filesize

          5.7MB

        • memory/4780-18-0x0000000001330000-0x0000000001331000-memory.dmp

          Filesize

          4KB

        • memory/4780-11-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-9-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-7-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-12-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-16-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-13-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB

        • memory/4780-6-0x0000000000400000-0x00000000004DB000-memory.dmp

          Filesize

          876KB