Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 07:44

General

  • Target

    6548f741cb41a51f5e5373586ce6b940.exe

  • Size

    271KB

  • MD5

    6548f741cb41a51f5e5373586ce6b940

  • SHA1

    291bad1c0d06c5af48005dc4eca7f76d5312845b

  • SHA256

    f958ce56b688316c3905d3de8770ad2f4e983b9b4824281cd285fecac12051f1

  • SHA512

    cd98f0379ed410890c2b2f279384c49ba7cdb82d11b5f6ed100b33c7755149893bcc2256ea2b842fbe1ad585a4e31cd752a7014f29cda036571a98ba98c9f5d8

  • SSDEEP

    6144:NZ/b9e1VGnTezP8KwPBVu0AlICpOgCKvZnmpz:U1mTeL8va08I+fmpz

Malware Config

Extracted

Family

redline

Botnet

@txtbaselinks

C2

91.92.252.103:61981

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
    "C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\CabCB0E.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\TarCB40.tmp

          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        • C:\Users\Admin\AppData\Local\Temp\tmpCD5E.tmp

          Filesize

          46KB

          MD5

          02d2c46697e3714e49f46b680b9a6b83

          SHA1

          84f98b56d49f01e9b6b76a4e21accf64fd319140

          SHA256

          522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

          SHA512

          60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

        • C:\Users\Admin\AppData\Local\Temp\tmpCD93.tmp

          Filesize

          92KB

          MD5

          90f2fbd833b63261c850b610a1648c23

          SHA1

          2d2f93ef843d704e442978150165f774e12c0df7

          SHA256

          f3d2266e66a73b2c5ca75641a7aa5e243b4a9457fe9e673477086c58365a597a

          SHA512

          9454c5942ef7852108d6f65d8106202da42fca0e4b3e99e9ee3e0af0051b0c99de0414f5eb9b9e65b048ecfafd16146bd106a6b561c731e2919ff0e4bd1be106

        • memory/2308-15-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-12-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-7-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-6-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-8-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-9-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2308-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2308-18-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

        • memory/2532-13-0x0000000000210000-0x0000000000211000-memory.dmp

          Filesize

          4KB

        • memory/2532-5-0x0000000000210000-0x0000000000211000-memory.dmp

          Filesize

          4KB

        • memory/2532-16-0x0000000074860000-0x0000000074F4E000-memory.dmp

          Filesize

          6.9MB

        • memory/2532-0-0x00000000008D0000-0x000000000091A000-memory.dmp

          Filesize

          296KB

        • memory/2532-2-0x0000000002360000-0x00000000023A0000-memory.dmp

          Filesize

          256KB

        • memory/2532-4-0x0000000000210000-0x0000000000211000-memory.dmp

          Filesize

          4KB

        • memory/2532-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2532-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

          Filesize

          6.9MB