Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    29-03-2024 11:59

General

  • Target

    tmp.exe

  • Size

    2.6MB

  • MD5

    55e393da1714013720ddf266c7906f43

  • SHA1

    91a636913604184c010c2d9e0b331a804a2c0ab4

  • SHA256

    6f10a5ac32b9f8b590199dd88c976057d19a6215224aafe45270dd3154d4b957

  • SHA512

    40a61e1d461717e45eff3be6b22561ac39c2ef1af39b46f7d149fe823d14a06bb99605a78e794d6447ece43ce6b4854192e47ad993ed4a2e78479bc7e155fe8a

  • SSDEEP

    49152:VvONaX/Lpt/IvKfeF4tIDpdIA/gvCRtDKYZ8NfBcPQSqzULJgxl6Y4KB7KkP3C+Y:VGNajwvKfpyMdvCRNZZ8NJcPQSEU9Q6z

Malware Config

Extracted

Family

redline

Botnet

tg

C2

163.5.112.53:51523

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAdABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGsAcABhACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGkAcwAgAGMAbwBtAHAAdQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwB1AHAAcABvAHIAdABlAGQALAAgAHAAbABlAGEAcwBlACAAdAByAHkAIABhAGcAYQBpAG4AIABvAG4AIABhAG4AbwB0AGgAZQByACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwB5AGMAYQAjAD4A"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2280
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAbABmACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAagBiACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYwBzACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGwAcAB5ACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1996
    • C:\Users\Admin\AppData\Roaming\a.exe
      "C:\Users\Admin\AppData\Roaming\a.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:3060
      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:548
        • C:\Windows\system32\wusa.exe
          wusa /uninstall /kb:890830 /quiet /norestart
          4⤵
          • Drops file in Windows directory
          PID:2256
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe delete "TDFIYZSJ"
        3⤵
        • Launches sc.exe
        PID:2852
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe create "TDFIYZSJ" binpath= "C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe" start= "auto"
        3⤵
        • Launches sc.exe
        PID:1676
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe stop eventlog
        3⤵
        • Launches sc.exe
        PID:1124
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start "TDFIYZSJ"
        3⤵
        • Launches sc.exe
        PID:2808
    • C:\Users\Admin\AppData\Roaming\b.exe
      "C:\Users\Admin\AppData\Roaming\b.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
  • C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
    C:\ProgramData\tcxbtjpidyhi\wfnmgjmvvtwt.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2204
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\system32\wusa.exe
        wusa /uninstall /kb:890830 /quiet /norestart
        3⤵
        • Drops file in Windows directory
        PID:2264
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
        PID:2432
      • C:\Windows\system32\conhost.exe
        conhost.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:484

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Create or Modify System Process

    2
    T1543

    Windows Service

    2
    T1543.003

    Privilege Escalation

    Create or Modify System Process

    2
    T1543

    Windows Service

    2
    T1543.003

    Defense Evasion

    Impair Defenses

    1
    T1562

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Impact

    Service Stop

    1
    T1489

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\TarA79C.tmp
      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Local\Temp\tmpB07E.tmp
      Filesize

      46KB

      MD5

      02d2c46697e3714e49f46b680b9a6b83

      SHA1

      84f98b56d49f01e9b6b76a4e21accf64fd319140

      SHA256

      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

      SHA512

      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

    • C:\Users\Admin\AppData\Local\Temp\tmpB0B3.tmp
      Filesize

      92KB

      MD5

      5f0d6f6c74d258570577755ce6fa9d92

      SHA1

      e08df69b5e2ef3da7f976b124f9cea8d4393c0cb

      SHA256

      7ddf34241a309c341c3b5223ba6e3dd83b8ad9988a173777fc392bbf317e0ceb

      SHA512

      f917bde1622e643cfab6bd33016eb37e962bf76ed733e3e92d9a45780ebb7075901c8f262d1eb828e17c488dcdca2a7093df605332347dd6414793ec123596f2

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      c3442a2ac18e634e4c315f9e3fb411e3

      SHA1

      2fdd8aaf97d2d41d5aa0f67e86d754c63816f6ea

      SHA256

      612e740a9e778bb0ec873010e6c406966b954457ba860e5ec380ac5f5c3d8c67

      SHA512

      f6b3ffe62cde525a29f41e2eff34e1f2c27fd55037b742b976cdeab6cd9afac999ebc7e78eb78b9f83f69d5f3228e18d936be894dcc73b8e6c9e93a2301c852a

    • C:\Users\Admin\AppData\Roaming\a.exe
      Filesize

      2.5MB

      MD5

      6fd62e635b39a02ba8cac6fc124c9475

      SHA1

      e13080b9cc546e44a9f1c419ba86aeb190a14b2d

      SHA256

      78b9d7e485026278b02a1961999ad99cdfa988fbf4403767db5d10d1473e9870

      SHA512

      e77432582e6abcc0fd86ed997c9c4619bd67a044d33a752e1cf3ceb8008cea27c540949183b80f9dee8a41614cff54afe79c5db294efcb72b27685fcf1010cdc

    • C:\Users\Admin\AppData\Roaming\b.exe
      Filesize

      95KB

      MD5

      184ac479b3a878e9ac5535770ca34a2b

      SHA1

      1f99039911cc2cfd1a62ce348429ddd0f4435a60

      SHA256

      8e28a0090832a76cf71c417cb1bf7990b9af86be258b732117a47f624387083c

      SHA512

      e0f5185ae890b902ea5325066df23959106712e7990e120a1b9752bbd0331cac968af5ddd6092f75a1c576d4c83f4093dfbf53a2c90870d1c02b31a0e8282bb4

    • memory/484-252-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-253-0x00000000000B0000-0x00000000000D0000-memory.dmp
      Filesize

      128KB

    • memory/484-267-0x0000000000550000-0x0000000000570000-memory.dmp
      Filesize

      128KB

    • memory/484-246-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-247-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-266-0x0000000000530000-0x0000000000550000-memory.dmp
      Filesize

      128KB

    • memory/484-263-0x0000000000550000-0x0000000000570000-memory.dmp
      Filesize

      128KB

    • memory/484-262-0x0000000000530000-0x0000000000550000-memory.dmp
      Filesize

      128KB

    • memory/484-250-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-261-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-249-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-260-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-259-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-248-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-258-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-257-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-256-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-255-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-254-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-265-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/484-251-0x0000000140000000-0x0000000140848000-memory.dmp
      Filesize

      8.3MB

    • memory/1996-24-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/1996-26-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/1996-34-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/1996-30-0x0000000002520000-0x0000000002560000-memory.dmp
      Filesize

      256KB

    • memory/1996-28-0x0000000002520000-0x0000000002560000-memory.dmp
      Filesize

      256KB

    • memory/2204-236-0x000007FEF4490000-0x000007FEF4E2D000-memory.dmp
      Filesize

      9.6MB

    • memory/2204-228-0x000007FEF4490000-0x000007FEF4E2D000-memory.dmp
      Filesize

      9.6MB

    • memory/2204-231-0x0000000000EF0000-0x0000000000F70000-memory.dmp
      Filesize

      512KB

    • memory/2204-232-0x000007FEF4490000-0x000007FEF4E2D000-memory.dmp
      Filesize

      9.6MB

    • memory/2204-229-0x0000000000EF0000-0x0000000000F70000-memory.dmp
      Filesize

      512KB

    • memory/2204-230-0x0000000000EF0000-0x0000000000F70000-memory.dmp
      Filesize

      512KB

    • memory/2204-233-0x0000000000EF0000-0x0000000000F70000-memory.dmp
      Filesize

      512KB

    • memory/2280-32-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/2280-25-0x00000000026E0000-0x0000000002720000-memory.dmp
      Filesize

      256KB

    • memory/2280-73-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/2280-235-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/2280-29-0x00000000026E0000-0x0000000002720000-memory.dmp
      Filesize

      256KB

    • memory/2280-31-0x00000000026E0000-0x0000000002720000-memory.dmp
      Filesize

      256KB

    • memory/2280-27-0x0000000072050000-0x00000000725FB000-memory.dmp
      Filesize

      5.7MB

    • memory/2408-215-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp
      Filesize

      9.6MB

    • memory/2408-213-0x000000001B160000-0x000000001B442000-memory.dmp
      Filesize

      2.9MB

    • memory/2408-220-0x0000000002780000-0x0000000002800000-memory.dmp
      Filesize

      512KB

    • memory/2408-222-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp
      Filesize

      9.6MB

    • memory/2408-221-0x0000000002780000-0x0000000002800000-memory.dmp
      Filesize

      512KB

    • memory/2408-218-0x0000000002780000-0x0000000002800000-memory.dmp
      Filesize

      512KB

    • memory/2408-217-0x000007FEF4E30000-0x000007FEF57CD000-memory.dmp
      Filesize

      9.6MB

    • memory/2408-216-0x0000000002780000-0x0000000002800000-memory.dmp
      Filesize

      512KB

    • memory/2408-214-0x0000000001F00000-0x0000000001F08000-memory.dmp
      Filesize

      32KB

    • memory/2432-241-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2432-244-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2432-240-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2432-237-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2432-239-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2432-238-0x0000000140000000-0x000000014000E000-memory.dmp
      Filesize

      56KB

    • memory/2672-219-0x0000000000250000-0x0000000000290000-memory.dmp
      Filesize

      256KB

    • memory/2672-35-0x0000000072BB0000-0x000000007329E000-memory.dmp
      Filesize

      6.9MB

    • memory/2672-264-0x0000000072BB0000-0x000000007329E000-memory.dmp
      Filesize

      6.9MB

    • memory/2672-23-0x0000000072BB0000-0x000000007329E000-memory.dmp
      Filesize

      6.9MB

    • memory/2672-22-0x0000000000140000-0x000000000015E000-memory.dmp
      Filesize

      120KB

    • memory/2672-33-0x0000000000250000-0x0000000000290000-memory.dmp
      Filesize

      256KB