Analysis
- max time kernel
93s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/04/2024, 10:31
General
- Target c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe
- Size 812KB
- Sample240402-mkfk9sfd83
- SHA256 c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b
Malware Config
Extracted
-
redline
-
cheat
-
185.222.58.253:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe"C:\Users\Admin\AppData\Local\Temp\c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PO.exe.log
PO.exe
PO.jpg
__PSScriptPolicyTest_ft4zd5rq.p2n.ps1
tmpC510.tmp
tmpC526.tmp
tmpC551.tmp
tmpC557.tmp
tmpC56D.tmp
tmpC598.tmp
memory/936-77-0x00000000074F0000-0x0000000007504000-memory.dmp
memory/936-79-0x00000000075D0000-0x00000000075D8000-memory.dmp
memory/936-82-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/936-30-0x0000000004B10000-0x0000000004B20000-memory.dmp
memory/936-78-0x00000000075F0000-0x000000000760A000-memory.dmp
memory/936-31-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/936-28-0x00000000049E0000-0x0000000004A16000-memory.dmp
memory/936-76-0x00000000074E0000-0x00000000074EE000-memory.dmp
memory/936-33-0x0000000005150000-0x0000000005778000-memory.dmp
memory/936-75-0x00000000074B0000-0x00000000074C1000-memory.dmp
memory/936-74-0x0000000007530000-0x00000000075C6000-memory.dmp
memory/936-35-0x0000000004FC0000-0x0000000004FE2000-memory.dmp
memory/936-73-0x0000000007330000-0x000000000733A000-memory.dmp
memory/936-71-0x0000000007900000-0x0000000007F7A000-memory.dmp
memory/936-44-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/936-37-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/936-72-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/936-70-0x0000000007180000-0x0000000007223000-memory.dmp
memory/936-51-0x0000000005BB0000-0x0000000005F04000-memory.dmp
memory/936-69-0x0000000004B10000-0x0000000004B20000-memory.dmp
memory/936-53-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/936-68-0x0000000004B10000-0x0000000004B20000-memory.dmp
memory/936-55-0x000000007F0A0000-0x000000007F0B0000-memory.dmp
memory/936-56-0x0000000006560000-0x0000000006592000-memory.dmp
memory/936-57-0x000000006EF70000-0x000000006EFBC000-memory.dmp
memory/936-67-0x00000000065A0000-0x00000000065BE000-memory.dmp
memory/3760-25-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3760-54-0x0000000005220000-0x000000000532A000-memory.dmp
memory/3760-52-0x0000000004FD0000-0x000000000501C000-memory.dmp
memory/3760-49-0x0000000004F90000-0x0000000004FCC000-memory.dmp
memory/3760-271-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/3760-43-0x0000000004F30000-0x0000000004F42000-memory.dmp
memory/3760-270-0x0000000007150000-0x000000000716E000-memory.dmp
memory/3760-34-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/3760-269-0x0000000006B70000-0x0000000006BE6000-memory.dmp
memory/3760-84-0x0000000006C00000-0x000000000712C000-memory.dmp
memory/3760-50-0x0000000004F20000-0x0000000004F30000-memory.dmp
memory/3760-36-0x0000000005550000-0x0000000005B68000-memory.dmp
memory/3760-83-0x0000000006500000-0x00000000066C2000-memory.dmp
memory/4696-18-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/4696-20-0x0000000004D60000-0x0000000004DFC000-memory.dmp
memory/4696-19-0x0000000004A80000-0x0000000004A8A000-memory.dmp
memory/4696-29-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/4696-17-0x0000000004AC0000-0x0000000004B52000-memory.dmp
memory/4696-16-0x0000000004FD0000-0x0000000005574000-memory.dmp
memory/4696-15-0x0000000072A90000-0x0000000073240000-memory.dmp
memory/4696-14-0x0000000000030000-0x00000000000B4000-memory.dmp
memory/4696-22-0x0000000004F20000-0x0000000004F2C000-memory.dmp
memory/4696-23-0x00000000063F0000-0x0000000006450000-memory.dmp
memory/4696-21-0x0000000004D40000-0x0000000004D52000-memory.dmp