Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 13:37
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240412-en
General
-
Target
file.exe
-
Size
3.8MB
-
MD5
acfc823a15fbc0247f1974b9a7dc7cf8
-
SHA1
3289cb74a353915117e7b1649acbff7449068018
-
SHA256
2b8795c54cc826e2f7c62a5c15088a1d9aa9ff31373abf710caacf4d0a5f1b81
-
SHA512
1429b568485669dd1376cf2082efa4dff7ac2042fab6ddc31889cb92087dfd4609399395935e47910f4c982f85e1e5b3dc6061e97258c5078a8791aa2d5b3568
-
SSDEEP
49152:2sr3b8LJA1/x5CQIcSlU9Jn03eHk5SyiZfOp7fgqjIr7vFKNrFeE:9fGJeHI2Jn0OHk5SbOpKwOE
Malware Config
Signatures
-
Detect ZGRat V1 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2084-0-0x0000000000BA0000-0x0000000000F5A000-memory.dmp family_zgrat_v1 behavioral1/memory/2592-22-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 behavioral1/memory/2592-24-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 behavioral1/memory/2592-26-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 behavioral1/memory/2592-30-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 behavioral1/memory/2592-28-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2592-22-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline behavioral1/memory/2592-24-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline behavioral1/memory/2592-26-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline behavioral1/memory/2592-30-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline behavioral1/memory/2592-28-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 2084 file.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 2084 set thread context of 2592 2084 file.exe MsBuild.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
MsBuild.exepid process 2592 MsBuild.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
MsBuild.exedescription pid process Token: SeDebugPrivilege 2592 MsBuild.exe Token: SeBackupPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeBackupPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe Token: SeSecurityPrivilege 2592 MsBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
file.exedescription pid process target process PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe PID 2084 wrote to memory of 2592 2084 file.exe MsBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TmpF2A9.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
\Users\Admin\AppData\Local\Temp\Protect544cd51a.dllFilesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
memory/2084-17-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-10-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-1-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2084-2-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2084-31-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2084-11-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-9-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-12-0x0000000000590000-0x00000000005A0000-memory.dmpFilesize
64KB
-
memory/2084-14-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-13-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-15-0x0000000005A60000-0x0000000005B60000-memory.dmpFilesize
1024KB
-
memory/2084-16-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-0-0x0000000000BA0000-0x0000000000F5A000-memory.dmpFilesize
3.7MB
-
memory/2084-3-0x0000000004D30000-0x0000000004D70000-memory.dmpFilesize
256KB
-
memory/2084-4-0x0000000005670000-0x0000000005802000-memory.dmpFilesize
1.6MB
-
memory/2592-32-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2592-28-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2592-26-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-22-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-18-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-24-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-30-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-35-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/2592-34-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2592-33-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/2592-20-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2592-41-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/2592-52-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB