Analysis
- max time kernel
136s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 01:43
General
- Target 9a39e9f69780a5c38628b9ef94cc8309c9ebb4272f837b19ed2fc09da998154e.exe
- Size 181KB
- Sample240422-b5apzadh28
- SHA256 9a39e9f69780a5c38628b9ef94cc8309c9ebb4272f837b19ed2fc09da998154e
Malware Config
Extracted
-
redline
-
cheat
-
195.10.205.79:30525
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Detects .NET executables utilizing NyanX-CAT C# Loader 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a39e9f69780a5c38628b9ef94cc8309c9ebb4272f837b19ed2fc09da998154e.exe"C:\Users\Admin\AppData\Local\Temp\9a39e9f69780a5c38628b9ef94cc8309c9ebb4272f837b19ed2fc09da998154e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\Build.exe"' -PropertyType 'String'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jv05hfkt.zq0.ps1
memory/316-6-0x0000000005B10000-0x0000000005B86000-memory.dmp
memory/316-2-0x0000000005DE0000-0x0000000006384000-memory.dmp
memory/316-3-0x00000000058D0000-0x0000000005962000-memory.dmp
memory/316-4-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/316-5-0x0000000005A80000-0x0000000005A8A000-memory.dmp
memory/316-16-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/316-7-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/316-8-0x0000000005A60000-0x0000000005A70000-memory.dmp
memory/316-9-0x0000000005B90000-0x0000000005BB2000-memory.dmp
memory/316-10-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
memory/316-0-0x0000000000E90000-0x0000000000EC4000-memory.dmp
memory/316-1-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-37-0x0000000005D70000-0x0000000005DBC000-memory.dmp
memory/4928-34-0x0000000005EB0000-0x00000000064C8000-memory.dmp
memory/4928-48-0x0000000004E10000-0x0000000004E20000-memory.dmp
memory/4928-47-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-40-0x0000000007840000-0x000000000794A000-memory.dmp
memory/4928-39-0x0000000004E10000-0x0000000004E20000-memory.dmp
memory/4928-12-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4928-22-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/4928-36-0x00000000050A0000-0x00000000050DC000-memory.dmp
memory/4928-35-0x0000000004E80000-0x0000000004E92000-memory.dmp
memory/5100-21-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/5100-19-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
memory/5100-14-0x0000000002AC0000-0x0000000002AF6000-memory.dmp
memory/5100-23-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/5100-17-0x0000000005560000-0x0000000005B88000-memory.dmp
memory/5100-20-0x00000000053F0000-0x0000000005412000-memory.dmp
memory/5100-38-0x00000000063C0000-0x00000000063DE000-memory.dmp
memory/5100-33-0x0000000005DE0000-0x0000000006134000-memory.dmp
memory/5100-41-0x0000000007340000-0x00000000073D6000-memory.dmp
memory/5100-42-0x00000000068C0000-0x00000000068DA000-memory.dmp
memory/5100-43-0x0000000006910000-0x0000000006932000-memory.dmp
memory/5100-46-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/5100-18-0x0000000002AB0000-0x0000000002AC0000-memory.dmp
memory/5100-15-0x0000000074550000-0x0000000074D00000-memory.dmp