Analysis
-
max time kernel
191s -
max time network
306s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
20-04-2024 18:31
Behavioral task
behavioral1
Sample
build.exe
Resource
win10-20240404-en
General
-
Target
build.exe
-
Size
95KB
-
MD5
870a26be3f9c1558f8c367249c03e57a
-
SHA1
17d395b0ca3d2d6323dbb8f5080ebbda4808dc66
-
SHA256
9f79d381354b5bca4548cedf3dd72b1fa7d4889c80d5dadaf50af4e14ee23eb4
-
SHA512
7d34842b9ceb80ab604fe641eb1e53efb33e994ffca3498c47c7a94604df4baedf24f3a714e3239d4418582cdab2348fe57e7f4e081dcafe400d5c8ece8f4f4c
-
SSDEEP
1536:Nqs4iqeHlbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed203teulgS6pIl:7/pVYH+zi0ZbYe1g0ujyzdaI
Malware Config
Extracted
redline
cheat
john-nil.gl.at.ply.gg:32513
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2276-0-0x0000000000EF0000-0x0000000000F0E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2276-0-0x0000000000EF0000-0x0000000000F0E000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
build.exepid process 2276 build.exe 2276 build.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
build.exedescription pid process Token: SeDebugPrivilege 2276 build.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2276-0-0x0000000000EF0000-0x0000000000F0E000-memory.dmpFilesize
120KB
-
memory/2276-1-0x0000000073D90000-0x000000007447E000-memory.dmpFilesize
6.9MB
-
memory/2276-2-0x0000000005D20000-0x0000000006326000-memory.dmpFilesize
6.0MB
-
memory/2276-3-0x0000000005730000-0x0000000005742000-memory.dmpFilesize
72KB
-
memory/2276-4-0x0000000005790000-0x00000000057CE000-memory.dmpFilesize
248KB
-
memory/2276-5-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB
-
memory/2276-6-0x00000000057D0000-0x000000000581B000-memory.dmpFilesize
300KB
-
memory/2276-7-0x0000000005A20000-0x0000000005B2A000-memory.dmpFilesize
1.0MB
-
memory/2276-8-0x0000000006C90000-0x0000000006E52000-memory.dmpFilesize
1.8MB
-
memory/2276-9-0x0000000007390000-0x00000000078BC000-memory.dmpFilesize
5.2MB
-
memory/2276-10-0x00000000078C0000-0x0000000007DBE000-memory.dmpFilesize
5.0MB
-
memory/2276-11-0x0000000006ED0000-0x0000000006F36000-memory.dmpFilesize
408KB
-
memory/2276-33-0x00000000071E0000-0x0000000007272000-memory.dmpFilesize
584KB
-
memory/2276-34-0x0000000007280000-0x00000000072F6000-memory.dmpFilesize
472KB
-
memory/2276-35-0x0000000007350000-0x000000000736E000-memory.dmpFilesize
120KB
-
memory/2276-36-0x0000000073D90000-0x000000007447E000-memory.dmpFilesize
6.9MB
-
memory/2276-37-0x0000000005700000-0x0000000005710000-memory.dmpFilesize
64KB