Analysis
- max time kernel
125s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/04/2024, 02:11
General
- Target sample3.exe
- Size 556KB
- Sample240407-cma4fsac6w
- SHA256 00971cb6265f2b6ec80830e5bd41ed8f6df0102fd99fdc23f7dfef3d2a28ac46
Malware Config
Extracted
-
redline
-
Roly
-
91.92.248.117:65012
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample3.exe"C:\Users\Admin\AppData\Local\Temp\sample3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\sample3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GorfBGg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GorfBGg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7F8.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\sample3.exe"C:\Users\Admin\AppData\Local\Temp\sample3.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
sample3.exe.log
__PSScriptPolicyTest_k5nm4pop.lhg.ps1
tmpA7F8.tmp
memory/1124-101-0x0000000005600000-0x0000000005610000-memory.dmp
memory/1124-47-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1124-58-0x0000000005880000-0x000000000598A000-memory.dmp
memory/1124-57-0x0000000005600000-0x0000000005610000-memory.dmp
memory/1124-56-0x0000000005610000-0x000000000564C000-memory.dmp
memory/1124-55-0x0000000005530000-0x0000000005542000-memory.dmp
memory/1124-54-0x0000000005C30000-0x0000000006248000-memory.dmp
memory/1124-53-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/1124-100-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/1620-23-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/1620-74-0x0000000006540000-0x000000000655E000-memory.dmp
memory/1620-85-0x00000000078C0000-0x0000000007F3A000-memory.dmp
memory/1620-63-0x000000006FE40000-0x000000006FE8C000-memory.dmp
memory/1620-87-0x00000000072F0000-0x00000000072FA000-memory.dmp
memory/1620-93-0x00000000075A0000-0x00000000075A8000-memory.dmp
memory/1620-25-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/1620-27-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/1620-92-0x00000000075C0000-0x00000000075DA000-memory.dmp
memory/1620-62-0x000000007EEB0000-0x000000007EEC0000-memory.dmp
memory/1620-88-0x0000000007500000-0x0000000007596000-memory.dmp
memory/1620-91-0x00000000074C0000-0x00000000074D4000-memory.dmp
memory/1620-46-0x0000000005AC0000-0x0000000005E14000-memory.dmp
memory/1620-99-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/1620-49-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/1620-89-0x0000000007480000-0x0000000007491000-memory.dmp
memory/1620-22-0x0000000004F80000-0x0000000004FA2000-memory.dmp
memory/1620-59-0x00000000025D0000-0x00000000025E0000-memory.dmp
memory/2064-50-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/2064-10-0x00000000091B0000-0x000000000924C000-memory.dmp
memory/2064-9-0x0000000006A50000-0x0000000006AB0000-memory.dmp
memory/2064-8-0x0000000005C70000-0x0000000005C7C000-memory.dmp
memory/2064-7-0x0000000005C50000-0x0000000005C58000-memory.dmp
memory/2064-6-0x0000000005B20000-0x0000000005B34000-memory.dmp
memory/2064-0-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/2064-1-0x0000000000D00000-0x0000000000D90000-memory.dmp
memory/2064-2-0x0000000005DA0000-0x0000000006344000-memory.dmp
memory/2064-5-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/2064-3-0x00000000057F0000-0x0000000005882000-memory.dmp
memory/2064-20-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/2064-4-0x00000000059D0000-0x00000000059E0000-memory.dmp
memory/4852-19-0x0000000005100000-0x0000000005728000-memory.dmp
memory/4852-86-0x0000000007380000-0x000000000739A000-memory.dmp
memory/4852-84-0x00000000070D0000-0x0000000007173000-memory.dmp
memory/4852-64-0x000000006FE40000-0x000000006FE8C000-memory.dmp
memory/4852-61-0x0000000006650000-0x0000000006682000-memory.dmp
memory/4852-60-0x000000007FCE0000-0x000000007FCF0000-memory.dmp
memory/4852-90-0x00000000075B0000-0x00000000075BE000-memory.dmp
memory/4852-51-0x00000000065E0000-0x000000000662C000-memory.dmp
memory/4852-24-0x0000000005960000-0x00000000059C6000-memory.dmp
memory/4852-26-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/4852-18-0x0000000000E10000-0x0000000000E20000-memory.dmp
memory/4852-17-0x0000000000E10000-0x0000000000E20000-memory.dmp
memory/4852-98-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/4852-16-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/4852-15-0x0000000004A90000-0x0000000004AC6000-memory.dmp