Analysis
-
max time kernel
84s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2024 03:36
Static task
static1
Behavioral task
behavioral1
Sample
MultiChecker by injuankanal.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
MultiChecker by injuankanal.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
MultiChecker by injuankanal.exe
-
Size
86.0MB
-
MD5
babe3da3eb741b6ed3ff61ff17e9b03a
-
SHA1
a71a4e3efe15498ab248eaddf09241bea80330a0
-
SHA256
f1b5484e2de6dd07f9d05819e5e969256cd18df1c96c794a9c0377c4ec177ffe
-
SHA512
1d1fe46ab9132a0ea92183de92d1e80b65cb06ed9bb4754b92b8ea8e98f7e3392cb74179d4125fcf9e0cf9fb1b3dd302115f155ef0973cbd9ec3d8e31da7cf14
-
SSDEEP
6144:lDKW1Fgbdl0TBBvjc/tebqa/95xaT390+8Jb1kek5H0usk7V1f7E:dh1Fk70TnvjcVNa15xaT39AbWeaUAD
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4844-8-0x0000000000400000-0x000000000042E000-memory.dmp family_redline -
.NET Reactor proctector 3 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/1828-1-0x00000000025D0000-0x0000000002610000-memory.dmp net_reactor behavioral2/memory/1828-2-0x0000000004BB0000-0x0000000004BC0000-memory.dmp net_reactor behavioral2/memory/1828-5-0x0000000004B20000-0x0000000004B5E000-memory.dmp net_reactor -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1828 set thread context of 4844 1828 MultiChecker by injuankanal.exe 85 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 4844 RegAsm.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4844 RegAsm.exe Token: SeDebugPrivilege 4740 taskmgr.exe Token: SeSystemProfilePrivilege 4740 taskmgr.exe Token: SeCreateGlobalPrivilege 4740 taskmgr.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe 4740 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85 PID 1828 wrote to memory of 4844 1828 MultiChecker by injuankanal.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\MultiChecker by injuankanal.exe"C:\Users\Admin\AppData\Local\Temp\MultiChecker by injuankanal.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4740
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3832
-
C:\Windows\System32\rrokzr.exe"C:\Windows\System32\rrokzr.exe"1⤵PID:4424