Resubmissions
09/04/2024, 07:01
240409-htps3scd2w1009/04/2024, 07:01
240409-htf6yacc9x1009/04/2024, 07:00
240409-hs6p7scc811009/04/2024, 07:00
240409-hss44scc7z1007/03/2024, 22:29
240307-2eh7jagg4110Analysis
- max time kernel
4s - max time network
82s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 07:00
General
- Target New Text Document mod.exe
- Size 8KB
- Sample240409-hs6p7scc81
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Malware Config
Extracted
-
redline
-
6077866846
-
https://pastebin.com/raw/KE5Mft0T
Extracted
-
metasploit
-
metasploit_stager
-
91.92.247.21:8405
Extracted
-
stealc
-
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Extracted
-
xworm
-
94.156.8.213:58002
-
Install_directory
%Public%
-
install_file
svchost.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 32 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 4 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\a\mQxBvlTA.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"C:\Users\Admin\AppData\Local\Temp\a\xIPJVPDq.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pZKTnvbx.exe"C:\Users\Admin\AppData\Local\Temp\pZKTnvbx.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted6077866846MVYQY.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"C:\Users\Admin\AppData\Local\Temp\a\i1gcbW1E.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"C:\Users\Admin\AppData\Local\Temp\a\disable-defender.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"C:\Users\Admin\AppData\Local\Temp\a\pclient.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\responsibilitylead.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"C:\Users\Admin\AppData\Local\Temp\a\MStore.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell Add-MpPreference -ExclusionExtension .exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionExtension .exe4⤵
-
-
-
C:\Windows\Temp\Temp.exe"C:\Windows\Temp\Temp.exe" -s3⤵
-
C:\Windows\Temp\Temp.exeC:\Windows\Temp\Temp.exe -s4⤵
-
-
-
C:\Windows\SysWOW64\MService.exe"C:\Windows\SysWOW64\MService.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Props.exe"C:\Users\Admin\AppData\Local\Temp\a\Props.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1234.exe"C:\Users\Admin\AppData\Local\Temp\a\1234.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u6g.0.exe"C:\Users\Admin\AppData\Local\Temp\u6g.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u6g.1.exe"C:\Users\Admin\AppData\Local\Temp\u6g.1.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 16403⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test2.exe"C:\Users\Admin\AppData\Local\Temp\a\test2.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1111.exe"C:\Users\Admin\AppData\Local\Temp\a\1111.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"C:\Users\Admin\AppData\Local\Temp\a\ISetup2.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe"C:\Users\Admin\AppData\Local\Temp\u1g0.0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe"C:\Users\Admin\AppData\Local\Temp\u1g0.1.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 4323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"C:\Users\Admin\AppData\Local\Temp\a\Tester.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Public\svchost.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\555.exe"C:\Users\Admin\AppData\Local\Temp\a\555.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exe"C:\Users\Admin\AppData\Local\Temp\a\Document.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a\medcallaboratory5.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 6963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"C:\Users\Admin\AppData\Local\Temp\a\securitycheck.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\a\PrintSpoofer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"C:\Users\Admin\AppData\Local\Temp\a\Adobe_update.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 7923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 232 -ip 2321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5592 -ip 55921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1872 -ip 18721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5764 -ip 57641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
responsibilitylead.exe
Tmp9A7B.tmp
__PSScriptPolicyTest_utlor2ba.yax.ps1
1111.exe
1234.exe
555.exe
Adobe_update.exe
Document.exe
ISetup2.exe
ISetup8.exe
MStore.exe
PrintSpoofer.exe
Props.exe
Tester.exe
crypted6077866846MVYQY.exe
disable-defender.exe
i1gcbW1E.exe
mQxBvlTA.exe
medcallaboratory5.exe
pclient.exe
securitycheck.exe
svchost.exe
test2.exe
wininit.exe
xIPJVPDq.exe
ioloDMLog.txt
pZKTnvbx.exe
u6g.0.exe
u6g.1.exe
memory/232-222-0x00000000049A0000-0x0000000004A0C000-memory.dmp
memory/232-220-0x0000000003000000-0x0000000003100000-memory.dmp
memory/232-229-0x0000000000400000-0x0000000002D44000-memory.dmp
memory/448-187-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-232-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-103-0x00000287E53B0000-0x00000287E53C0000-memory.dmp
memory/448-385-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/448-307-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-299-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-294-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-288-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-270-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-282-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-280-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-276-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-102-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/448-268-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-262-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-259-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-256-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-254-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-244-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-249-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-165-0x00000287E54C0000-0x00000287E5736000-memory.dmp
memory/448-234-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-230-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-168-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-166-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-227-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-225-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-185-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-223-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-93-0x00000287CAD60000-0x00000287CAD66000-memory.dmp
memory/448-219-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-200-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-192-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-205-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-208-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/448-211-0x00000287E54C0000-0x00000287E5731000-memory.dmp
memory/464-35-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-212-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-14-0x0000000000A30000-0x0000000001B4C000-memory.dmp
memory/464-23-0x0000000077162000-0x0000000077163000-memory.dmp
memory/464-83-0x0000000003740000-0x000000000388E000-memory.dmp
memory/464-214-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-210-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-24-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-29-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-30-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-32-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-72-0x0000000006320000-0x00000000063B2000-memory.dmp
memory/464-215-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-63-0x0000000000A30000-0x0000000001B4C000-memory.dmp
memory/464-81-0x00000000062A0000-0x00000000062AA000-memory.dmp
memory/464-163-0x0000000076BD0000-0x0000000076CC0000-memory.dmp
memory/464-44-0x0000000077164000-0x0000000077166000-memory.dmp
memory/464-151-0x0000000006460000-0x0000000006470000-memory.dmp
memory/464-150-0x0000000000A30000-0x0000000001B4C000-memory.dmp
memory/464-69-0x0000000006830000-0x0000000006DD4000-memory.dmp
memory/464-100-0x0000000006290000-0x00000000062A4000-memory.dmp
memory/464-61-0x0000000000A30000-0x0000000001B4C000-memory.dmp
memory/1052-371-0x00000000006F0000-0x0000000000706000-memory.dmp
memory/1052-378-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/1832-372-0x0000000000400000-0x0000000002D21000-memory.dmp
memory/1832-343-0x0000000002DF0000-0x0000000002EF0000-memory.dmp
memory/1832-352-0x0000000002DB0000-0x0000000002DD7000-memory.dmp
memory/1872-376-0x0000000003010000-0x0000000003110000-memory.dmp
memory/1956-164-0x0000000000E60000-0x0000000000E64000-memory.dmp
memory/2340-365-0x0000000000280000-0x00000000002CA000-memory.dmp
memory/2340-388-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/2716-167-0x0000000007690000-0x0000000007BBC000-memory.dmp
memory/2716-101-0x0000000005BA0000-0x0000000005BB2000-memory.dmp
memory/2716-62-0x0000000005610000-0x0000000005676000-memory.dmp
memory/2716-96-0x0000000006170000-0x0000000006788000-memory.dmp
memory/2716-188-0x0000000007210000-0x000000000722E000-memory.dmp
memory/2716-60-0x00000000745B0000-0x0000000074D60000-memory.dmp
memory/2716-121-0x0000000006C50000-0x0000000006C9C000-memory.dmp
memory/2716-184-0x00000000074F0000-0x0000000007566000-memory.dmp
memory/2716-116-0x0000000005740000-0x0000000005750000-memory.dmp
memory/2716-120-0x0000000006C10000-0x0000000006C4C000-memory.dmp
memory/2716-258-0x0000000007600000-0x0000000007650000-memory.dmp
memory/2716-161-0x0000000006F90000-0x0000000007152000-memory.dmp
memory/2716-106-0x0000000005CD0000-0x0000000005DDA000-memory.dmp
memory/2716-381-0x00000000745B0000-0x0000000074D60000-memory.dmp
memory/2716-48-0x0000000000DA0000-0x0000000000DC2000-memory.dmp
memory/3636-118-0x0000000140000000-0x0000000140004278-memory.dmp
memory/4368-137-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/4368-123-0x00000278C4720000-0x00000278C4742000-memory.dmp
memory/4368-134-0x00000278AC0B0000-0x00000278AC0C0000-memory.dmp
memory/4368-124-0x00000278AC0B0000-0x00000278AC0C0000-memory.dmp
memory/4368-122-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/5072-119-0x0000000000A60000-0x0000000000A70000-memory.dmp
memory/5072-115-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp
memory/5072-0-0x0000000000180000-0x0000000000188000-memory.dmp
memory/5072-2-0x0000000000A60000-0x0000000000A70000-memory.dmp
memory/5072-1-0x00007FFA2BAA0000-0x00007FFA2C561000-memory.dmp