Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 01:02
Static task
static1
Behavioral task
behavioral1
Sample
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe
Resource
win7-20231129-en
General
-
Target
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe
-
Size
5.1MB
-
MD5
c7eea9d0d8f7bf74bd7c25990458bcf8
-
SHA1
4a03f78ca6f3df3c692ad31d2bdee7cb58b86c3d
-
SHA256
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10
-
SHA512
f96c4065120546987623633edfbd3568207bb92c6740eded13f69809b388085d29702f32fe26069f661a671b7e43e4f6050876e7d2514f71a5ed866535dae0bc
-
SSDEEP
98304:HkCjNtZ5Zo/Lq84Ti1hG9mzE1HKzf9hdspe0GZNfb9eTGf:HkEP5e/Lq84Ti1I6E1HUcSvb9eTGf
Malware Config
Extracted
lumma
https://rocketmusclesksj.shop/api
https://entitlementappwo.shop/api
https://economicscreateojsu.shop/api
https://pushjellysingeywus.shop/api
https://absentconvicsjawun.shop/api
https://suitcaseacanehalk.shop/api
https://bordersoarmanusjuw.shop/api
https://mealplayerpreceodsju.shop/api
https://wifeplasterbakewis.shop/api
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/220-29-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/220-29-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exeAddInProcess32.exedescription pid process target process PID 1600 set thread context of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 set thread context of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 4764 set thread context of 220 4764 AddInProcess32.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exeAddInProcess32.exeInstallUtil.exepid process 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe 4764 AddInProcess32.exe 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe 4764 AddInProcess32.exe 220 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exeAddInProcess32.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe Token: SeDebugPrivilege 4764 AddInProcess32.exe Token: SeDebugPrivilege 220 InstallUtil.exe Token: SeBackupPrivilege 220 InstallUtil.exe Token: SeSecurityPrivilege 220 InstallUtil.exe Token: SeSecurityPrivilege 220 InstallUtil.exe Token: SeSecurityPrivilege 220 InstallUtil.exe Token: SeSecurityPrivilege 220 InstallUtil.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exeAddInProcess32.exedescription pid process target process PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 4764 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3564 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 1600 wrote to memory of 3284 1600 28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe AddInProcess32.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe PID 4764 wrote to memory of 220 4764 AddInProcess32.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe"C:\Users\Admin\AppData\Local\Temp\28794b11097d9740a1bfce3e06458bccdccc167ceb75a140b4d031d052528d10.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:3564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵PID:3284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/220-29-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/220-47-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/220-46-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/220-45-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/220-43-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/220-42-0x0000000009A80000-0x0000000009C42000-memory.dmpFilesize
1.8MB
-
memory/220-44-0x000000000A510000-0x000000000AA3C000-memory.dmpFilesize
5.2MB
-
memory/220-41-0x0000000008430000-0x000000000844E000-memory.dmpFilesize
120KB
-
memory/220-40-0x0000000008BF0000-0x0000000008C66000-memory.dmpFilesize
472KB
-
memory/220-39-0x0000000008270000-0x00000000082D6000-memory.dmpFilesize
408KB
-
memory/220-38-0x0000000008150000-0x000000000819C000-memory.dmpFilesize
304KB
-
memory/220-37-0x0000000007FF0000-0x000000000802C000-memory.dmpFilesize
240KB
-
memory/220-36-0x0000000007F90000-0x0000000007FA2000-memory.dmpFilesize
72KB
-
memory/220-35-0x0000000008040000-0x000000000814A000-memory.dmpFilesize
1.0MB
-
memory/220-34-0x00000000084D0000-0x0000000008AE8000-memory.dmpFilesize
6.1MB
-
memory/220-33-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/220-32-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/1600-11-0x00000000053C0000-0x00000000053C6000-memory.dmpFilesize
24KB
-
memory/1600-7-0x0000000008060000-0x00000000080BA000-memory.dmpFilesize
360KB
-
memory/1600-1-0x0000000000FE0000-0x0000000001508000-memory.dmpFilesize
5.2MB
-
memory/1600-2-0x0000000005EC0000-0x0000000006464000-memory.dmpFilesize
5.6MB
-
memory/1600-3-0x00000000059B0000-0x0000000005A42000-memory.dmpFilesize
584KB
-
memory/1600-4-0x0000000005A50000-0x0000000005AEC000-memory.dmpFilesize
624KB
-
memory/1600-5-0x0000000005BA0000-0x0000000005BB0000-memory.dmpFilesize
64KB
-
memory/1600-6-0x0000000005960000-0x000000000596A000-memory.dmpFilesize
40KB
-
memory/1600-8-0x000000000A7B0000-0x000000000A7B6000-memory.dmpFilesize
24KB
-
memory/1600-9-0x0000000005BA0000-0x0000000005BB0000-memory.dmpFilesize
64KB
-
memory/1600-28-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/1600-10-0x0000000005380000-0x000000000539A000-memory.dmpFilesize
104KB
-
memory/1600-0-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/1600-12-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/1600-13-0x0000000005BA0000-0x0000000005BB0000-memory.dmpFilesize
64KB
-
memory/1600-14-0x0000000005BA0000-0x0000000005BB0000-memory.dmpFilesize
64KB
-
memory/3284-26-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3284-25-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4764-18-0x0000000005B90000-0x0000000005BA0000-memory.dmpFilesize
64KB
-
memory/4764-17-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/4764-31-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/4764-16-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/4764-15-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/4764-24-0x0000000005B90000-0x0000000005BA0000-memory.dmpFilesize
64KB
-
memory/4764-23-0x0000000074420000-0x0000000074BD0000-memory.dmpFilesize
7.7MB
-
memory/4764-22-0x0000000007920000-0x0000000007926000-memory.dmpFilesize
24KB
-
memory/4764-21-0x00000000078C0000-0x00000000078DA000-memory.dmpFilesize
104KB
-
memory/4764-20-0x0000000005B90000-0x0000000005BA0000-memory.dmpFilesize
64KB
-
memory/4764-19-0x0000000005800000-0x0000000005844000-memory.dmpFilesize
272KB