Analysis
-
max time kernel
190s -
max time network
304s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20-04-2024 14:31
General
-
Target
build.exe
-
Size
95KB
-
MD5
61491b49f5279ae09205b009f9e80b50
-
SHA1
c782b86f219cf6776ce6c5345f300169e492669f
-
SHA256
32691d92b5fa1c718dd81e137d154c7c0a5cc9f2c9f490abdab49bcbe0895be8
-
SHA512
299746bc4728556d46e674fed288fff52225d4ec6a3ccae181efbae701517fc335306072a7e59fb20cac964c1c9e90c226546daa22fe533af38f75acbdcf3488
-
SSDEEP
1536:RqsqFqJklbG6jejoigIg43Ywzi0Zb78ivombfexv0ujXyyed213tmulgS6pE:/6ScYg+zi0ZbYe1g0ujyzdBE
Malware Config
Extracted
Family
redline
Botnet
cheat
C2
requires-rear.gl.at.ply.gg:32266
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2812-0-0x0000000000520000-0x000000000053E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2812-0-0x0000000000520000-0x000000000053E000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
build.exepid process 2812 build.exe 2812 build.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
build.exedescription pid process Token: SeDebugPrivilege 2812 build.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2812-0-0x0000000000520000-0x000000000053E000-memory.dmpFilesize
120KB
-
memory/2812-1-0x0000000073610000-0x0000000073CFE000-memory.dmpFilesize
6.9MB
-
memory/2812-2-0x00000000054E0000-0x0000000005AE6000-memory.dmpFilesize
6.0MB
-
memory/2812-3-0x0000000004D40000-0x0000000004D52000-memory.dmpFilesize
72KB
-
memory/2812-4-0x0000000004DA0000-0x0000000004DDE000-memory.dmpFilesize
248KB
-
memory/2812-5-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/2812-6-0x0000000004DE0000-0x0000000004E2B000-memory.dmpFilesize
300KB
-
memory/2812-7-0x0000000005050000-0x000000000515A000-memory.dmpFilesize
1.0MB
-
memory/2812-8-0x0000000073610000-0x0000000073CFE000-memory.dmpFilesize
6.9MB
-
memory/2812-9-0x0000000006200000-0x00000000063C2000-memory.dmpFilesize
1.8MB
-
memory/2812-10-0x0000000006900000-0x0000000006E2C000-memory.dmpFilesize
5.2MB
-
memory/2812-11-0x0000000006450000-0x00000000064C6000-memory.dmpFilesize
472KB
-
memory/2812-12-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/2812-13-0x0000000007330000-0x000000000782E000-memory.dmpFilesize
5.0MB
-
memory/2812-14-0x0000000006670000-0x000000000668E000-memory.dmpFilesize
120KB
-
memory/2812-15-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/2812-16-0x0000000007F50000-0x0000000007FB6000-memory.dmpFilesize
408KB