Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 18:47

General

  • Target

    5738d596be68071de7786712b5410024.exe

  • Size

    2.3MB

  • MD5

    5738d596be68071de7786712b5410024

  • SHA1

    6245023401af7c614e5dcb61d657f41c17233ccd

  • SHA256

    03469423c7c63f0144fc8e3135db3efd65f0a15bbc80c374236792f820633310

  • SHA512

    93e08c9d3c194f4fa290113eb9bae836b79f512ae2b8a0c68430c3acd4ac170d1f6d47b2ff3ce0d673651afed388ad8206acd9856122b7d95972e8c9827d2668

  • SSDEEP

    49152:hYVPdezBnlW4Es4e3yIvLb59ou2cfJ6xiz8lVHTIioOFZQ+y:hkQlQ4tTP7xJ6xiqZ7y

Malware Config

Extracted

Family

redline

Botnet

@janhidf

C2

45.14.12.90:52072

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5738d596be68071de7786712b5410024.exe
    "C:\Users\Admin\AppData\Local\Temp\5738d596be68071de7786712b5410024.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ready\main.bat" /S"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\system32\mode.com
        mode 65,10
        3⤵
          PID:3928
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e file.zip -p___________20689pwd2342pwd16763___________ -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_8.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4488
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_2.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2632
        • C:\Users\Admin\AppData\Local\Temp\ready\janhidf.exe
          "janhidf.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
        • C:\Windows\system32\attrib.exe
          attrib +H "janhidf.exe"
          3⤵
          • Views/modifies file attributes
          PID:4660
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_1.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_3.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3360
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_4.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_5.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3132
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_6.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2144
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_7.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1700
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_9.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4376
        • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
          7z.exe e extracted/file_10.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2840

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\ready\7z.dll

            Filesize

            1.6MB

            MD5

            72491c7b87a7c2dd350b727444f13bb4

            SHA1

            1e9338d56db7ded386878eab7bb44b8934ab1bc7

            SHA256

            34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

            SHA512

            583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

          • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe

            Filesize

            458KB

            MD5

            619f7135621b50fd1900ff24aade1524

            SHA1

            6c7ea8bbd435163ae3945cbef30ef6b9872a4591

            SHA256

            344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

            SHA512

            2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

          • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe

            Filesize

            129KB

            MD5

            f1ceb742b0adaa20196016a3a94d454b

            SHA1

            4482fa8c46273bfdec7b28f2154ea03d07b611ca

            SHA256

            fbcb24ed51dc5cdecff1a7b883f401907f526a0331d5c966f50112ffe2c4bc01

            SHA512

            f1754053fdd5eaa11053d66c812d825bf5273bf93f9a31927bf21c3b6cf29e880c4617602fb0633c57a3106eecc60bff89e9502567c2893ba409387a6216999d

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_10.zip

            Filesize

            1.5MB

            MD5

            5bb135d42aac5b8fea4c41e4f0e682fb

            SHA1

            7f462309a386c1f2b496f9f7b972458dd513af9f

            SHA256

            7cf3d534397c1618d5984387ea3d319744a1c9fc450d01003f5953355fb9128b

            SHA512

            4026241c9f003c9a96286b235d3314fe2e0212d914f255242dadc0e454a71adaed6f67fc8a4b49c7fda285a5bb9ec1ae703723a0c1942906b0060d299b1e4df8

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_5.zip

            Filesize

            40KB

            MD5

            285d432d435cd6fb30a14b26d785ae5c

            SHA1

            1bba0e1cd964177543561233df0117f210184610

            SHA256

            82123a06b9ed0f527fed2d987b222befb12023e077bc0187c15ca7389351043f

            SHA512

            f6c2c6eebd2e1c451f4a4cbb92ee81601a24df97584a6636bf712fe23ba6e2adf2b1c3b1b62de2f28cd0eeb93d07cac12c96548897be42c093c885995c5131a6

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_6.zip

            Filesize

            41KB

            MD5

            110d098300a79bf77df3e1f9dc000854

            SHA1

            7fc902980a6ad5c49d2a1592b17aa94d6cd63bc6

            SHA256

            3b5a7ae6a43ca5e3cb3280a6463ed79f7ae688eeae2a81114d24d1bc8f8048c3

            SHA512

            7e4051d93a0f543a686e9b0bb5d705ee542a1658ab60f7e23c517a6221b2f8bc11f2c22442b58a5a9eb602078bc03956908cab6adf0dca501b975d1a6940cedd

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_7.zip

            Filesize

            41KB

            MD5

            d9f067d9b53e9dac1d72d801b5348c12

            SHA1

            ccdfdf4205d670f422facdfc772405ae11096000

            SHA256

            e00256861aca90c8f701ab67cd4442cee23ace47ebb7fe87d368814701f013ab

            SHA512

            950c1b2b805bfa666eafb6acd6ffababc40373110c567e70b15fe54d06a505a26656b94361d09ae00c64929d46726c439b6c041e2200988b6c76c05fbe29b098

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_8.zip

            Filesize

            41KB

            MD5

            f268400b4f4630f70e6220f9f73ca770

            SHA1

            f7c0717bb47ef3d3f075d7fbe62ae9146cccd561

            SHA256

            5216fd47e01f7a9c5dd503f3576c2bb6b54f5bdf51f942c4e0c230eaa5a3a0b4

            SHA512

            a7ef869820d1294431c5a351bb423c024af5b07d4adc6abe50074996dfefbb05ddf68451cb060ecc263d85a608195f3206aaf9eaa2c9e7bb8ab573e51deb63e1

          • C:\Users\Admin\AppData\Local\Temp\ready\extracted\file_9.zip

            Filesize

            41KB

            MD5

            7be328380791baf2e2427349b5ac2b08

            SHA1

            1b10efbfeca8ba85dd4af53b1066ee338bba9120

            SHA256

            14a5a7e340f07b9859bd2694f7aa7f71f2a6f31400afc0d16ce79db740190d95

            SHA512

            1bc4672bc9b6178b5baa1934ce6114c0a0c4d052df45099ac4a946c8ad360f8bf9a1d56e8bccb8847571a333c809698da798f8d0308dfeaf35501dfa1407be4c

          • C:\Users\Admin\AppData\Local\Temp\ready\file.bin

            Filesize

            1.2MB

            MD5

            4c8c55cced3cb71d93234a2dd5bfb21a

            SHA1

            d439bc492d1e0b95923eec971ca4af617a7e0f9c

            SHA256

            28dc476829c3c92271d67791becd6e7623e7b15ef2f44d0602c9b1435dc67500

            SHA512

            cb6114635dc4f0a33a75ef8b9cc5e9fe4a1495b1e44ddab8ed08ec42922cb410fe65a3942055375de12ff2427c275a02134f7e19fb844561daa1b86f6371fe5e

          • C:\Users\Admin\AppData\Local\Temp\ready\main.bat

            Filesize

            486B

            MD5

            3afb4af06ef85bcec37d3493910949b7

            SHA1

            8dece16a9f45866453ee6af0f1cabaaef5b11448

            SHA256

            c17d67303f4483cb9a3c3e3f974a26c6c4482f1042aba973cc4a37c686d0803f

            SHA512

            832067f4f08e111d22aef14ff0a2d86b9e86ae6ae193cfe33486c30c7cd172aa64d19f0729ced4dd3bb08f28feffd992dec416d1d383fc308ac4640c34dae180

          • memory/5040-84-0x0000000073A90000-0x0000000074240000-memory.dmp

            Filesize

            7.7MB

          • memory/5040-90-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB

          • memory/5040-92-0x00000000063D0000-0x00000000064DA000-memory.dmp

            Filesize

            1.0MB

          • memory/5040-91-0x0000000006260000-0x00000000062AC000-memory.dmp

            Filesize

            304KB

          • memory/5040-86-0x00000000064F0000-0x0000000006B08000-memory.dmp

            Filesize

            6.1MB

          • memory/5040-89-0x0000000005580000-0x00000000055BC000-memory.dmp

            Filesize

            240KB

          • memory/5040-88-0x0000000005450000-0x0000000005462000-memory.dmp

            Filesize

            72KB

          • memory/5040-87-0x00000000054A0000-0x0000000005532000-memory.dmp

            Filesize

            584KB

          • memory/5040-85-0x0000000005920000-0x0000000005EC4000-memory.dmp

            Filesize

            5.6MB

          • memory/5040-83-0x00000000008E0000-0x00000000008FE000-memory.dmp

            Filesize

            120KB

          • memory/5040-93-0x0000000073A90000-0x0000000074240000-memory.dmp

            Filesize

            7.7MB

          • memory/5040-94-0x00000000056C0000-0x00000000056D0000-memory.dmp

            Filesize

            64KB