Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 07:43

General

  • Target

    6548f741cb41a51f5e5373586ce6b940.exe

  • Size

    271KB

  • MD5

    6548f741cb41a51f5e5373586ce6b940

  • SHA1

    291bad1c0d06c5af48005dc4eca7f76d5312845b

  • SHA256

    f958ce56b688316c3905d3de8770ad2f4e983b9b4824281cd285fecac12051f1

  • SHA512

    cd98f0379ed410890c2b2f279384c49ba7cdb82d11b5f6ed100b33c7755149893bcc2256ea2b842fbe1ad585a4e31cd752a7014f29cda036571a98ba98c9f5d8

  • SSDEEP

    6144:NZ/b9e1VGnTezP8KwPBVu0AlICpOgCKvZnmpz:U1mTeL8va08I+fmpz

Malware Config

Extracted

Family

redline

Botnet

@txtbaselinks

C2

91.92.252.103:61981

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
    "C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1528
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1260

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\CabD931.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\TarD992.tmp

            Filesize

            171KB

            MD5

            9c0c641c06238516f27941aa1166d427

            SHA1

            64cd549fb8cf014fcd9312aa7a5b023847b6c977

            SHA256

            4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

            SHA512

            936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

          • C:\Users\Admin\AppData\Local\Temp\tmpDEB6.tmp

            Filesize

            46KB

            MD5

            02d2c46697e3714e49f46b680b9a6b83

            SHA1

            84f98b56d49f01e9b6b76a4e21accf64fd319140

            SHA256

            522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

            SHA512

            60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

          • C:\Users\Admin\AppData\Local\Temp\tmpDEFA.tmp

            Filesize

            92KB

            MD5

            c5ab22deca134f4344148b20687651f4

            SHA1

            c36513b27480dc2d134cefb29a44510a00ec988d

            SHA256

            1e9bd8064ca87d8441e2702005ef8df9a3647d5542740737abb8a70be7ec9512

            SHA512

            550f45132525e967d749106b9d3b114d17b066967527bfd5c66613d61b6f3995f87b0f3c09def19eed14b5b757f2501645b5103505d126f1dd66994f50e1257e

          • memory/1256-21-0x0000000074260000-0x000000007494E000-memory.dmp

            Filesize

            6.9MB

          • memory/1256-1-0x0000000074260000-0x000000007494E000-memory.dmp

            Filesize

            6.9MB

          • memory/1256-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

            Filesize

            256KB

          • memory/1256-3-0x0000000000370000-0x0000000000371000-memory.dmp

            Filesize

            4KB

          • memory/1256-4-0x0000000000380000-0x0000000000381000-memory.dmp

            Filesize

            4KB

          • memory/1256-5-0x0000000000380000-0x0000000000381000-memory.dmp

            Filesize

            4KB

          • memory/1256-0-0x00000000003F0000-0x000000000043A000-memory.dmp

            Filesize

            296KB

          • memory/1256-17-0x0000000000380000-0x0000000000381000-memory.dmp

            Filesize

            4KB

          • memory/1260-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1260-19-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-16-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-22-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-12-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-10-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-8-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB

          • memory/1260-6-0x0000000000400000-0x000000000041E000-memory.dmp

            Filesize

            120KB