Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 13:37
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240412-en
General
-
Target
file.exe
-
Size
3.8MB
-
MD5
acfc823a15fbc0247f1974b9a7dc7cf8
-
SHA1
3289cb74a353915117e7b1649acbff7449068018
-
SHA256
2b8795c54cc826e2f7c62a5c15088a1d9aa9ff31373abf710caacf4d0a5f1b81
-
SHA512
1429b568485669dd1376cf2082efa4dff7ac2042fab6ddc31889cb92087dfd4609399395935e47910f4c982f85e1e5b3dc6061e97258c5078a8791aa2d5b3568
-
SSDEEP
49152:2sr3b8LJA1/x5CQIcSlU9Jn03eHk5SyiZfOp7fgqjIr7vFKNrFeE:9fGJeHI2Jn0OHk5SbOpKwOE
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral2/memory/448-1-0x0000000000C80000-0x000000000103A000-memory.dmp family_zgrat_v1 behavioral2/memory/1152-21-0x0000000000400000-0x00000000004C0000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1152-21-0x0000000000400000-0x00000000004C0000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 448 file.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 448 set thread context of 1152 448 file.exe MsBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MsBuild.exepid process 1152 MsBuild.exe 1152 MsBuild.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
MsBuild.exedescription pid process Token: SeDebugPrivilege 1152 MsBuild.exe Token: SeBackupPrivilege 1152 MsBuild.exe Token: SeSecurityPrivilege 1152 MsBuild.exe Token: SeSecurityPrivilege 1152 MsBuild.exe Token: SeSecurityPrivilege 1152 MsBuild.exe Token: SeSecurityPrivilege 1152 MsBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
file.exedescription pid process target process PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe PID 448 wrote to memory of 1152 448 file.exe MsBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dllFilesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
C:\Users\Admin\AppData\Local\Temp\Tmp6F0.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
memory/448-12-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-15-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-4-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-5-0x0000000005EE0000-0x0000000006072000-memory.dmpFilesize
1.6MB
-
memory/448-2-0x0000000005A10000-0x0000000005AAC000-memory.dmpFilesize
624KB
-
memory/448-11-0x0000000005EC0000-0x0000000005ED0000-memory.dmpFilesize
64KB
-
memory/448-1-0x0000000000C80000-0x000000000103A000-memory.dmpFilesize
3.7MB
-
memory/448-13-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-14-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-3-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/448-16-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-17-0x0000000005A00000-0x0000000005A10000-memory.dmpFilesize
64KB
-
memory/448-18-0x0000000006360000-0x0000000006460000-memory.dmpFilesize
1024KB
-
memory/448-20-0x0000000006360000-0x0000000006460000-memory.dmpFilesize
1024KB
-
memory/448-19-0x0000000006360000-0x0000000006460000-memory.dmpFilesize
1024KB
-
memory/448-0-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/448-23-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/1152-25-0x0000000005360000-0x0000000005904000-memory.dmpFilesize
5.6MB
-
memory/1152-35-0x0000000008CF0000-0x0000000008D66000-memory.dmpFilesize
472KB
-
memory/1152-26-0x0000000004E50000-0x0000000004EE2000-memory.dmpFilesize
584KB
-
memory/1152-27-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1152-28-0x0000000004FF0000-0x0000000004FFA000-memory.dmpFilesize
40KB
-
memory/1152-29-0x0000000008550000-0x0000000008B68000-memory.dmpFilesize
6.1MB
-
memory/1152-30-0x00000000080C0000-0x00000000081CA000-memory.dmpFilesize
1.0MB
-
memory/1152-31-0x0000000008010000-0x0000000008022000-memory.dmpFilesize
72KB
-
memory/1152-32-0x0000000008070000-0x00000000080AC000-memory.dmpFilesize
240KB
-
memory/1152-33-0x00000000081D0000-0x000000000821C000-memory.dmpFilesize
304KB
-
memory/1152-34-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/1152-24-0x00000000747B0000-0x0000000074F60000-memory.dmpFilesize
7.7MB
-
memory/1152-36-0x0000000008C70000-0x0000000008C8E000-memory.dmpFilesize
120KB
-
memory/1152-37-0x0000000009940000-0x0000000009B02000-memory.dmpFilesize
1.8MB
-
memory/1152-38-0x000000000A040000-0x000000000A56C000-memory.dmpFilesize
5.2MB
-
memory/1152-39-0x00000000747B0000-0x0000000074F60000-memory.dmpFilesize
7.7MB
-
memory/1152-41-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1152-42-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1152-43-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1152-46-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/1152-21-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/1152-65-0x00000000747B0000-0x0000000074F60000-memory.dmpFilesize
7.7MB