Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240319-en -
resource tags
-
submitted
29/03/2024, 17:07
General
-
Target
99009031caaab6da320715182c2762983f1e24509c8604273e0f23db35839c52.exe
-
Size
365KB
-
MD5
d6e04d811cf7ab3ae9d204a325000d2a
-
SHA1
b0cae7a4a0b87a7ce38ff61a1577af5f8b4f1112
-
SHA256
99009031caaab6da320715182c2762983f1e24509c8604273e0f23db35839c52
-
SHA512
9497d1170dd084852e7f81e3eeca9874931b24388be2f4ba9fed0f21f67f27832b2454b968cc74d2e8c240aae60168e2796fa29fe1618051f8ed3a8b2906b5db
-
SSDEEP
6144:yvd8MVkBm5k0lm7ifuf3Q7Sn3ie1K285zSXLJ+ChLvxUQafQ:SROBmC0uo7SnH15NXL4ChNaQ
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 35 IoCs
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99009031caaab6da320715182c2762983f1e24509c8604273e0f23db35839c52.exe"C:\Users\Admin\AppData\Local\Temp\99009031caaab6da320715182c2762983f1e24509c8604273e0f23db35839c52.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 27042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2348 -ip 23481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD53e578e493d10ff95d57f3eabf87db62a
SHA1af6af1157581ba250caa300022b74cbd49743459
SHA2564281e5eb63353dca0e797c631d1aa3f14d1dc848de1ad376bb359ae03e2d6bac
SHA51296b65879efe84034d0a4a805a9d13bbdaee9a479b1bfd9bbe1e6677a3669330e902e6a021edad2c071ffb52abc3e313db860da843feeb42e39f1f88c86ee995f
-
Filesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
Filesize
20KB
MD522be08f683bcc01d7a9799bbd2c10041
SHA12efb6041cf3d6e67970135e592569c76fc4c41de
SHA256451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA5120eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
-
Filesize
112KB
MD587210e9e528a4ddb09c6b671937c79c6
SHA13c75314714619f5b55e25769e0985d497f0062f2
SHA256eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
SHA512f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
-
Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
232KB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
244KB
-
Filesize
200KB
-
Filesize
7.0MB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
244KB
-
Filesize
7.0MB
-
Filesize
7.7MB
-
Filesize
7.0MB
-
Filesize
7.7MB