Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/01/2024, 02:55
General
- Target tungbot.exe
- Size 234KB
- Sample240113-defveaagcn
- SHA256 52de83987941b92875cecdd1661cc2757eae4f02ef564fd2e147d06eb9d8ab44
Malware Config
Extracted
-
redline
-
cheat
-
103.173.227.25:12664
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tungbot.exe"C:\Users\Admin\AppData\Local\Temp\tungbot.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\tungbot.exec:\users\admin\appdata\local\temp\tungbot.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp893C.tmp
tmp8961.tmp
tmp8977.tmp
tmp89D7.tmp
tmp89DD.tmp
tmp8A08.tmp
tungbot.exe
explorer.exe
icsys.icn.exe
spoolsv.exe
svchost.exe
memory/944-50-0x0000000000400000-0x000000000041F000-memory.dmp
memory/1680-24-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2028-55-0x00000000075F0000-0x0000000007602000-memory.dmp
memory/2028-61-0x00000000090B0000-0x0000000009116000-memory.dmp
memory/2028-52-0x0000000005660000-0x0000000005670000-memory.dmp
memory/2028-53-0x0000000007030000-0x00000000070C2000-memory.dmp
memory/2028-54-0x00000000076F0000-0x0000000007D08000-memory.dmp
memory/2028-239-0x0000000005660000-0x0000000005670000-memory.dmp
memory/2028-56-0x0000000008F70000-0x0000000008FAC000-memory.dmp
memory/2028-57-0x0000000006510000-0x000000000655C000-memory.dmp
memory/2028-58-0x0000000007240000-0x000000000734A000-memory.dmp
memory/2028-59-0x0000000009280000-0x0000000009442000-memory.dmp
memory/2028-60-0x0000000009980000-0x0000000009EAC000-memory.dmp
memory/2028-238-0x0000000005660000-0x0000000005670000-memory.dmp
memory/2028-237-0x0000000005660000-0x0000000005670000-memory.dmp
memory/2028-236-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/2028-45-0x0000000005AA0000-0x0000000006044000-memory.dmp
memory/2028-235-0x0000000009230000-0x000000000924E000-memory.dmp
memory/2028-37-0x0000000000BF0000-0x0000000000C10000-memory.dmp
memory/2028-23-0x00000000748E0000-0x0000000075090000-memory.dmp
memory/2028-234-0x00000000095D0000-0x0000000009646000-memory.dmp
memory/3200-51-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3200-0-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3688-49-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3940-44-0x0000000000400000-0x000000000041F000-memory.dmp
memory/3940-48-0x0000000000400000-0x000000000041F000-memory.dmp