Analysis Overview
SHA256
f958ce56b688316c3905d3de8770ad2f4e983b9b4824281cd285fecac12051f1
Threat Level: Known bad
The file 6548f741cb41a51f5e5373586ce6b940.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
SectopRAT payload
SectopRAT
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-14 07:43
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-14 07:43
Reported
2024-01-14 07:46
Platform
win7-20231215-en
Max time kernel
121s
Max time network
125s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1256 set thread context of 1260 | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
"C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Network
| Country | Destination | Domain | Proto |
| BG | 91.92.252.103:61981 | 91.92.252.103 | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
Files
memory/1256-0-0x00000000003F0000-0x000000000043A000-memory.dmp
memory/1256-1-0x0000000074260000-0x000000007494E000-memory.dmp
memory/1256-2-0x0000000004D10000-0x0000000004D50000-memory.dmp
memory/1256-3-0x0000000000370000-0x0000000000371000-memory.dmp
memory/1256-4-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1256-5-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1260-6-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1260-8-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1260-10-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1260-12-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1260-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1256-17-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1260-16-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1260-19-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1256-21-0x0000000074260000-0x000000007494E000-memory.dmp
memory/1260-22-0x0000000000400000-0x000000000041E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabD931.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\TarD992.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\tmpDEB6.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmpDEFA.tmp
| MD5 | c5ab22deca134f4344148b20687651f4 |
| SHA1 | c36513b27480dc2d134cefb29a44510a00ec988d |
| SHA256 | 1e9bd8064ca87d8441e2702005ef8df9a3647d5542740737abb8a70be7ec9512 |
| SHA512 | 550f45132525e967d749106b9d3b114d17b066967527bfd5c66613d61b6f3995f87b0f3c09def19eed14b5b757f2501645b5103505d126f1dd66994f50e1257e |
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-14 07:43
Reported
2024-01-14 07:46
Platform
win10v2004-20231215-en
Max time kernel
136s
Max time network
127s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4628 set thread context of 4152 | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
"C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| BG | 91.92.252.103:61981 | 91.92.252.103 | tcp |
| US | 8.8.8.8:53 | 180.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.252.92.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 31.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.135.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
Files
memory/4628-0-0x0000000000D00000-0x0000000000D4A000-memory.dmp
memory/4628-1-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/4628-3-0x0000000005650000-0x0000000005651000-memory.dmp
memory/4628-2-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/4628-4-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
memory/4152-5-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4628-6-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
memory/4628-9-0x0000000074AB0000-0x0000000075260000-memory.dmp
memory/4152-10-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/4152-11-0x0000000005B40000-0x00000000060E4000-memory.dmp
memory/4152-13-0x0000000005720000-0x00000000057B2000-memory.dmp
memory/4152-12-0x0000000006710000-0x0000000006D28000-memory.dmp
memory/4152-14-0x00000000056B0000-0x00000000056C2000-memory.dmp
memory/4152-15-0x0000000005800000-0x000000000583C000-memory.dmp
memory/4152-16-0x0000000005710000-0x0000000005720000-memory.dmp
memory/4152-17-0x00000000065E0000-0x000000000662C000-memory.dmp
memory/4152-18-0x00000000080A0000-0x00000000081AA000-memory.dmp
memory/4152-19-0x0000000008750000-0x0000000008912000-memory.dmp
memory/4152-20-0x0000000008E50000-0x000000000937C000-memory.dmp
memory/4152-21-0x0000000008600000-0x0000000008676000-memory.dmp
memory/4152-22-0x00000000086E0000-0x00000000086FE000-memory.dmp
memory/4152-23-0x0000000008CD0000-0x0000000008D36000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp66AA.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmp66C0.tmp
| MD5 | d63e3a8d4109b7212d419e17141dd862 |
| SHA1 | c9637da0763277477e60128ae2cd26fb314fa80a |
| SHA256 | 0cdd05fd9d9515c99e713a0cdf201fae20cd5db884c08a292ce16471725c521f |
| SHA512 | dfee6ccabfe03415bea0d817ac0c393e98b54a0dfff102f0eee21c8e85d903e11a073aa97b7a3e8b95d88d5f86afd4c9782e7618e3119727da1e01d4895315e2 |
C:\Users\Admin\AppData\Local\Temp\tmp6707.tmp
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Local\Temp\tmp6732.tmp
| MD5 | d367ddfda80fdcf578726bc3b0bc3e3c |
| SHA1 | 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671 |
| SHA256 | 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0 |
| SHA512 | 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77 |
C:\Users\Admin\AppData\Local\Temp\tmp6701.tmp
| MD5 | 49693267e0adbcd119f9f5e02adf3a80 |
| SHA1 | 3ba3d7f89b8ad195ca82c92737e960e1f2b349df |
| SHA256 | d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f |
| SHA512 | b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2 |
C:\Users\Admin\AppData\Local\Temp\tmp66EB.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
memory/4152-205-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/4152-206-0x0000000005710000-0x0000000005720000-memory.dmp
memory/4152-208-0x0000000074770000-0x0000000074F20000-memory.dmp