Analysis
- max time kernel
135s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/04/2024, 01:51
General
- Target c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe
- Size 812KB
- Sample240403-b969qscf88
- SHA256 c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b
Malware Config
Extracted
-
redline
-
cheat
-
185.222.58.253:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects executables packed with SmartAssembly 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe"C:\Users\Admin\AppData\Local\Temp\c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PO.exe.log
PO.exe
PO.jpg
__PSScriptPolicyTest_bk22t0zl.ftc.ps1
memory/3080-21-0x0000000005080000-0x0000000005092000-memory.dmp
memory/3080-18-0x0000000004E70000-0x0000000004E80000-memory.dmp
memory/3080-19-0x0000000004F20000-0x0000000004F2A000-memory.dmp
memory/3080-20-0x00000000051D0000-0x000000000526C000-memory.dmp
memory/3080-17-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/3080-22-0x00000000050A0000-0x00000000050AC000-memory.dmp
memory/3080-23-0x00000000068A0000-0x0000000006900000-memory.dmp
memory/3080-16-0x0000000005480000-0x0000000005A24000-memory.dmp
memory/3080-26-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/3080-15-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/3080-14-0x00000000004C0000-0x0000000000544000-memory.dmp
memory/3080-30-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4236-68-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/4236-73-0x0000000006ED0000-0x0000000006EDA000-memory.dmp
memory/4236-82-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4236-35-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4236-36-0x0000000002440000-0x0000000002450000-memory.dmp
memory/4236-38-0x0000000002440000-0x0000000002450000-memory.dmp
memory/4236-39-0x0000000004DE0000-0x0000000005408000-memory.dmp
memory/4236-79-0x0000000007180000-0x0000000007188000-memory.dmp
memory/4236-78-0x00000000071A0000-0x00000000071BA000-memory.dmp
memory/4236-77-0x00000000070A0000-0x00000000070B4000-memory.dmp
memory/4236-76-0x0000000007090000-0x000000000709E000-memory.dmp
memory/4236-42-0x0000000004C10000-0x0000000004C32000-memory.dmp
memory/4236-43-0x0000000005410000-0x0000000005476000-memory.dmp
memory/4236-44-0x0000000005480000-0x00000000054E6000-memory.dmp
memory/4236-75-0x0000000007060000-0x0000000007071000-memory.dmp
memory/4236-54-0x0000000005600000-0x0000000005954000-memory.dmp
memory/4236-55-0x0000000005B30000-0x0000000005B4E000-memory.dmp
memory/4236-56-0x000000007F9D0000-0x000000007F9E0000-memory.dmp
memory/4236-57-0x0000000006100000-0x0000000006132000-memory.dmp
memory/4236-58-0x000000006FA90000-0x000000006FADC000-memory.dmp
memory/4236-74-0x00000000070E0000-0x0000000007176000-memory.dmp
memory/4236-69-0x0000000002440000-0x0000000002450000-memory.dmp
memory/4236-70-0x0000000006D00000-0x0000000006DA3000-memory.dmp
memory/4236-71-0x00000000074A0000-0x0000000007B1A000-memory.dmp
memory/4236-72-0x0000000006E60000-0x0000000006E7A000-memory.dmp
memory/4236-33-0x0000000000D00000-0x0000000000D36000-memory.dmp
memory/4400-25-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4400-31-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4400-41-0x00000000056C0000-0x00000000057CA000-memory.dmp
memory/4400-32-0x0000000005840000-0x0000000005E58000-memory.dmp
memory/4400-40-0x0000000005460000-0x00000000054AC000-memory.dmp
memory/4400-37-0x0000000005420000-0x000000000545C000-memory.dmp
memory/4400-34-0x00000000053C0000-0x00000000053D2000-memory.dmp
memory/4400-83-0x0000000072F70000-0x0000000073720000-memory.dmp