Analysis Overview
SHA256
f958ce56b688316c3905d3de8770ad2f4e983b9b4824281cd285fecac12051f1
Threat Level: Known bad
The file 6548f741cb41a51f5e5373586ce6b940.exe was found to be: Known bad.
Malicious Activity Summary
RedLine
RedLine payload
SectopRAT
SectopRAT payload
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-14 07:44
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-14 07:44
Reported
2024-01-14 07:46
Platform
win7-20231215-en
Max time kernel
121s
Max time network
125s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2532 set thread context of 2308 | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
"C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Network
| Country | Destination | Domain | Proto |
| BG | 91.92.252.103:61981 | 91.92.252.103 | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
Files
memory/2532-0-0x00000000008D0000-0x000000000091A000-memory.dmp
memory/2532-1-0x0000000074860000-0x0000000074F4E000-memory.dmp
memory/2532-3-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/2532-4-0x0000000000210000-0x0000000000211000-memory.dmp
memory/2532-2-0x0000000002360000-0x00000000023A0000-memory.dmp
memory/2532-5-0x0000000000210000-0x0000000000211000-memory.dmp
memory/2308-7-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2308-6-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2308-8-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2308-9-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2308-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2308-12-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2532-13-0x0000000000210000-0x0000000000211000-memory.dmp
memory/2308-18-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2532-16-0x0000000074860000-0x0000000074F4E000-memory.dmp
memory/2308-15-0x0000000000400000-0x000000000041E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabCB0E.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\Local\Temp\TarCB40.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\tmpCD5E.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmpCD93.tmp
| MD5 | 90f2fbd833b63261c850b610a1648c23 |
| SHA1 | 2d2f93ef843d704e442978150165f774e12c0df7 |
| SHA256 | f3d2266e66a73b2c5ca75641a7aa5e243b4a9457fe9e673477086c58365a597a |
| SHA512 | 9454c5942ef7852108d6f65d8106202da42fca0e4b3e99e9ee3e0af0051b0c99de0414f5eb9b9e65b048ecfafd16146bd106a6b561c731e2919ff0e4bd1be106 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-14 07:44
Reported
2024-01-14 07:46
Platform
win10v2004-20231215-en
Max time kernel
156s
Max time network
153s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4816 set thread context of 1932 | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe
"C:\Users\Admin\AppData\Local\Temp\6548f741cb41a51f5e5373586ce6b940.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| BG | 91.92.252.103:61981 | 91.92.252.103 | tcp |
| US | 8.8.8.8:53 | 114.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.252.92.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 31.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
Files
memory/4816-0-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/4816-1-0x0000000000EF0000-0x0000000000F3A000-memory.dmp
memory/4816-2-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/4816-3-0x0000000005840000-0x0000000005841000-memory.dmp
memory/4816-4-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/4816-5-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/1932-6-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4816-7-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/4816-9-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/1932-10-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/1932-11-0x0000000005360000-0x0000000005904000-memory.dmp
memory/1932-12-0x0000000005F30000-0x0000000006548000-memory.dmp
memory/1932-13-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/1932-14-0x0000000004ED0000-0x0000000004EE2000-memory.dmp
memory/1932-15-0x0000000005090000-0x00000000050CC000-memory.dmp
memory/1932-16-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/1932-17-0x00000000077B0000-0x00000000077FC000-memory.dmp
memory/1932-18-0x0000000007910000-0x0000000007A1A000-memory.dmp
memory/1932-19-0x0000000007E30000-0x0000000007FF2000-memory.dmp
memory/1932-20-0x0000000008530000-0x0000000008A5C000-memory.dmp
memory/1932-21-0x0000000008000000-0x0000000008076000-memory.dmp
memory/1932-22-0x00000000080C0000-0x00000000080DE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp8326.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmp835B.tmp
| MD5 | ec564f686dd52169ab5b8535e03bb579 |
| SHA1 | 08563d6c547475d11edae5fd437f76007889275a |
| SHA256 | 43c07a345be732ff337e3826d82f5e220b9474b00242e335c0abb9e3fcc03433 |
| SHA512 | aa9e3cb1ae365fd5a20439bca6f7c79331a08d2f7660a36c5b8b4f57a0e51c2392b8e00f3d58af479134531dc0e6b4294210b3633f64723abd7f4bc4db013df9 |
C:\Users\Admin\AppData\Local\Temp\tmp83B5.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\tmp83DA.tmp
| MD5 | 49693267e0adbcd119f9f5e02adf3a80 |
| SHA1 | 3ba3d7f89b8ad195ca82c92737e960e1f2b349df |
| SHA256 | d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f |
| SHA512 | b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2 |
C:\Users\Admin\AppData\Local\Temp\tmp83F0.tmp
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Local\Temp\tmp842B.tmp
| MD5 | d367ddfda80fdcf578726bc3b0bc3e3c |
| SHA1 | 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671 |
| SHA256 | 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0 |
| SHA512 | 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77 |
memory/1932-177-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/1932-178-0x0000000008440000-0x00000000084A6000-memory.dmp
memory/1932-206-0x0000000004F00000-0x0000000004F10000-memory.dmp
memory/1932-208-0x0000000074EE0000-0x0000000075690000-memory.dmp