Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 08:30
Static task
static1
Behavioral task
behavioral1
Sample
79c2644b6900df6336a9feddde98eae4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79c2644b6900df6336a9feddde98eae4.exe
Resource
win10v2004-20231215-en
General
-
Target
79c2644b6900df6336a9feddde98eae4.exe
-
Size
798KB
-
MD5
79c2644b6900df6336a9feddde98eae4
-
SHA1
3717e912455e85d0262356aebccc937f0a4790d2
-
SHA256
bed4c9f14696cc59c90575c491b4b60208c9cb602da5b29a63cdabbf448135fe
-
SHA512
9e3f644519c36d7001c6a89f6f5191d4b8d2de5371f9336671eb5639313fb711e66dca89fd72bea94962c69ce30085833006ee3e21d47a787ab8f03eaf885d11
-
SSDEEP
12288:Yakftd38PlWKAi7oqXncg4+prNEnlmxkgcCMV29hJl5i8oirqGONZORMCjPeOAOK:zkftNiroqn4kNEZVHShPY8oWONWtAT
Malware Config
Extracted
redline
190.2.145.47:80
Extracted
redline
@big_tastyyy
87.251.71.44:80
Extracted
redline
@TyBaby_LZT
135.181.171.9:16077
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/756-36-0x0000000000CC0000-0x0000000000D2B000-memory.dmp family_redline behavioral2/memory/3068-47-0x00000000045E0000-0x000000000461E000-memory.dmp family_redline behavioral2/memory/3068-50-0x0000000006A10000-0x0000000006A4C000-memory.dmp family_redline behavioral2/memory/756-52-0x0000000000CC0000-0x0000000000D2B000-memory.dmp family_redline behavioral2/memory/3724-63-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/756-36-0x0000000000CC0000-0x0000000000D2B000-memory.dmp family_sectoprat behavioral2/memory/3068-47-0x00000000045E0000-0x000000000461E000-memory.dmp family_sectoprat behavioral2/memory/3068-50-0x0000000006A10000-0x0000000006A4C000-memory.dmp family_sectoprat behavioral2/memory/756-52-0x0000000000CC0000-0x0000000000D2B000-memory.dmp family_sectoprat behavioral2/memory/3724-63-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
79c2644b6900df6336a9feddde98eae4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 79c2644b6900df6336a9feddde98eae4.exe -
Executes dropped EXE 4 IoCs
Processes:
ElopingWipes_2021-08-25_06-25.exeQIQytlRs.exeEmbryulciaBrogues.exeEmbryulciaBrogues.exepid process 3068 ElopingWipes_2021-08-25_06-25.exe 756 QIQytlRs.exe 1376 EmbryulciaBrogues.exe 3724 EmbryulciaBrogues.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
QIQytlRs.exepid process 756 QIQytlRs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
EmbryulciaBrogues.exedescription pid process target process PID 1376 set thread context of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3200 756 WerFault.exe QIQytlRs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
QIQytlRs.exepid process 756 QIQytlRs.exe 756 QIQytlRs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EmbryulciaBrogues.exedescription pid process Token: SeDebugPrivilege 1376 EmbryulciaBrogues.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
79c2644b6900df6336a9feddde98eae4.exeEmbryulciaBrogues.exedescription pid process target process PID 660 wrote to memory of 3068 660 79c2644b6900df6336a9feddde98eae4.exe ElopingWipes_2021-08-25_06-25.exe PID 660 wrote to memory of 3068 660 79c2644b6900df6336a9feddde98eae4.exe ElopingWipes_2021-08-25_06-25.exe PID 660 wrote to memory of 3068 660 79c2644b6900df6336a9feddde98eae4.exe ElopingWipes_2021-08-25_06-25.exe PID 660 wrote to memory of 756 660 79c2644b6900df6336a9feddde98eae4.exe QIQytlRs.exe PID 660 wrote to memory of 756 660 79c2644b6900df6336a9feddde98eae4.exe QIQytlRs.exe PID 660 wrote to memory of 756 660 79c2644b6900df6336a9feddde98eae4.exe QIQytlRs.exe PID 660 wrote to memory of 1376 660 79c2644b6900df6336a9feddde98eae4.exe EmbryulciaBrogues.exe PID 660 wrote to memory of 1376 660 79c2644b6900df6336a9feddde98eae4.exe EmbryulciaBrogues.exe PID 660 wrote to memory of 1376 660 79c2644b6900df6336a9feddde98eae4.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe PID 1376 wrote to memory of 3724 1376 EmbryulciaBrogues.exe EmbryulciaBrogues.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79c2644b6900df6336a9feddde98eae4.exe"C:\Users\Admin\AppData\Local\Temp\79c2644b6900df6336a9feddde98eae4.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ElopingWipes_2021-08-25_06-25.exe"C:\Users\Admin\AppData\Local\Temp\ElopingWipes_2021-08-25_06-25.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\QIQytlRs.exe"C:\Users\Admin\AppData\Local\Temp\QIQytlRs.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 6483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\EmbryulciaBrogues.exe"C:\Users\Admin\AppData\Local\Temp\EmbryulciaBrogues.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EmbryulciaBrogues.exeC:\Users\Admin\AppData\Local\Temp\EmbryulciaBrogues.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 756 -ip 7561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EmbryulciaBrogues.exe.logFilesize
605B
MD53654bd2c6957761095206ffdf92b0cb9
SHA16f10f7b5867877de7629afcff644c265e79b4ad3
SHA256c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4
SHA512e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79
-
C:\Users\Admin\AppData\Local\Temp\ElopingWipes_2021-08-25_06-25.exeFilesize
374KB
MD563665ffe06f433fcb09e1c5e59e4b1f8
SHA1ff2b82f65a571604cccf4bc7a86187ca9c3395bf
SHA25641bd154116c00826902a3e904d67c9c793053049747accfd51b5197da74088e2
SHA5129563a31a0affd483d935792667438f73e9d88d644b0a4790fde0d9ffd8f22274dde044bb195c3dec4b943d015b9dcfcad978175ab9527bbd04bd42380c17aea8
-
C:\Users\Admin\AppData\Local\Temp\ElopingWipes_2021-08-25_06-25.exeFilesize
375KB
MD5318c869e2886127dddb2a220988cf599
SHA1c46432e774f29bae1ceff19811a6677bdbc6c1b6
SHA256711d639857ca6c94d659089a21d9abc021b7ca5280d93b0f0c9d8c19eb9c8764
SHA512460ac5fa165e7a139e2794a85f57ddd664b69671a6673950214158748ac18688c3f0807ecf3d2612a47078b89223e76e25438670f5834978ba075c64454f89a4
-
C:\Users\Admin\AppData\Local\Temp\EmbryulciaBrogues.exeFilesize
335KB
MD57f47e20941352fca134e8deeac04272e
SHA1a9208a7c524e2b89552031a120b4a08ecf42ef52
SHA256be00573c3c61abe2e6adc4e9a547d3d85b0d763e2ac528ab2865592a89d1f5ba
SHA512f23b610735966b4e651cdc7233f23aaf1b1bb791f934b5d639123bb76dda6242feb2b45b4f9b6556c47ac9d3dd798b801b09e84b6d03ce2c216236096aab2f63
-
C:\Users\Admin\AppData\Local\Temp\QIQytlRs.exeFilesize
321KB
MD52761c51aea2b127686a8b27770dc4170
SHA15719cf591f3883a0b6f4b74263256c1930b073b6
SHA256f0dcac79c7f0978978beaab834c504bf2e97d0aef5c200f7ac91cd43f9b9503f
SHA512edc33a2682613237c8214a908837cd8aee154cdab34fcdd182069db0d143a0aee5f1dc5e972a3613f8861e5de8922bf32c7bb31e3a43ed10d4772d2e93ed3bec
-
memory/660-0-0x00000000006B0000-0x000000000077E000-memory.dmpFilesize
824KB
-
memory/660-1-0x00007FFC9EBD0000-0x00007FFC9F691000-memory.dmpFilesize
10.8MB
-
memory/660-32-0x00007FFC9EBD0000-0x00007FFC9F691000-memory.dmpFilesize
10.8MB
-
memory/756-36-0x0000000000CC0000-0x0000000000D2B000-memory.dmpFilesize
428KB
-
memory/756-27-0x0000000000CC0000-0x0000000000D2B000-memory.dmpFilesize
428KB
-
memory/756-34-0x0000000000810000-0x0000000000856000-memory.dmpFilesize
280KB
-
memory/756-39-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/756-38-0x0000000000810000-0x0000000000856000-memory.dmpFilesize
280KB
-
memory/756-53-0x0000000075030000-0x0000000075082000-memory.dmpFilesize
328KB
-
memory/756-52-0x0000000000CC0000-0x0000000000D2B000-memory.dmpFilesize
428KB
-
memory/756-51-0x0000000000810000-0x0000000000856000-memory.dmpFilesize
280KB
-
memory/1376-41-0x0000000000010000-0x000000000006A000-memory.dmpFilesize
360KB
-
memory/1376-67-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/1376-44-0x0000000004820000-0x000000000483E000-memory.dmpFilesize
120KB
-
memory/1376-43-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/1376-42-0x0000000004840000-0x00000000048B6000-memory.dmpFilesize
472KB
-
memory/1376-40-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3068-50-0x0000000006A10000-0x0000000006A4C000-memory.dmpFilesize
240KB
-
memory/3068-61-0x0000000006B50000-0x0000000006B60000-memory.dmpFilesize
64KB
-
memory/3068-48-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3068-47-0x00000000045E0000-0x000000000461E000-memory.dmpFilesize
248KB
-
memory/3068-54-0x0000000007730000-0x0000000007D48000-memory.dmpFilesize
6.1MB
-
memory/3068-56-0x0000000007110000-0x000000000721A000-memory.dmpFilesize
1.0MB
-
memory/3068-55-0x0000000006A90000-0x0000000006AA2000-memory.dmpFilesize
72KB
-
memory/3068-57-0x0000000000400000-0x00000000023C8000-memory.dmpFilesize
31.8MB
-
memory/3068-58-0x0000000006AB0000-0x0000000006AEC000-memory.dmpFilesize
240KB
-
memory/3068-60-0x0000000006B50000-0x0000000006B60000-memory.dmpFilesize
64KB
-
memory/3068-59-0x0000000006B50000-0x0000000006B60000-memory.dmpFilesize
64KB
-
memory/3068-49-0x0000000006B60000-0x0000000007104000-memory.dmpFilesize
5.6MB
-
memory/3068-62-0x0000000007220000-0x000000000726C000-memory.dmpFilesize
304KB
-
memory/3068-75-0x0000000006B50000-0x0000000006B60000-memory.dmpFilesize
64KB
-
memory/3068-46-0x0000000003FD0000-0x000000000401E000-memory.dmpFilesize
312KB
-
memory/3068-45-0x00000000024B0000-0x00000000025B0000-memory.dmpFilesize
1024KB
-
memory/3068-74-0x0000000006B50000-0x0000000006B60000-memory.dmpFilesize
64KB
-
memory/3068-72-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3068-71-0x00000000024B0000-0x00000000025B0000-memory.dmpFilesize
1024KB
-
memory/3724-69-0x0000000005A40000-0x0000000005A50000-memory.dmpFilesize
64KB
-
memory/3724-68-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/3724-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3724-76-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB