Analysis
-
max time kernel
125s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 01:22
Static task
static1
Behavioral task
behavioral1
Sample
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe
Resource
win7-20240221-en
General
-
Target
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe
-
Size
900KB
-
MD5
768ead51112582920104d0f4bb5f0902
-
SHA1
2aab7b0d33e9662af0e8ab9c6f5b3171108efdb5
-
SHA256
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737
-
SHA512
79b22df121afea9f987dda8a14a77c26460db0086881e68ec20587b1c0395ad5432e1ab7d34f50b7eabf6a47c9797d7107e82aeddcaf0c112c117b15b369d11f
-
SSDEEP
12288:pMfqXESqNnb4XKgpwzpZBl+F87bTvrW6C1C0vdXLE38CeWwa6nIz0t2jiCnSGc32:hBqNnb4Xlpir+67b1yCvsJait2uWRRb
Malware Config
Extracted
redline
cheat
45.137.22.186:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2636-34-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2636-37-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2636-36-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2636-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2636-31-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2636-34-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2636-37-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2636-36-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2636-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2636-31-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2636-34-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2636-37-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2636-36-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2636-29-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2636-31-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-20-0x0000000000470000-0x0000000000486000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Executes dropped EXE 2 IoCs
Processes:
PO.exePO.exepid process 1720 PO.exe 2636 PO.exe -
Loads dropped DLL 1 IoCs
Processes:
PO.exepid process 1720 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 1720 set thread context of 2636 1720 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
PO.exepowershell.exepid process 1720 PO.exe 1720 PO.exe 1720 PO.exe 1720 PO.exe 2652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO.exePO.exepowershell.exedescription pid process Token: SeDebugPrivilege 1720 PO.exe Token: SeDebugPrivilege 2636 PO.exe Token: SeDebugPrivilege 2652 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exePO.exedescription pid process target process PID 2180 wrote to memory of 1720 2180 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 2180 wrote to memory of 1720 2180 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 2180 wrote to memory of 1720 2180 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 2180 wrote to memory of 1720 2180 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 1720 wrote to memory of 2652 1720 PO.exe powershell.exe PID 1720 wrote to memory of 2652 1720 PO.exe powershell.exe PID 1720 wrote to memory of 2652 1720 PO.exe powershell.exe PID 1720 wrote to memory of 2652 1720 PO.exe powershell.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe PID 1720 wrote to memory of 2636 1720 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe"C:\Users\Admin\AppData\Local\Temp\4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
575KB
MD55e1f47df7bc7d9b80fe2ea5c04855ef4
SHA1dad41763607a024c3c161d6d1a48309d15017328
SHA256589e3616ce7e091b3d4f38ffc5217154fbea5f46ec77f0e7dc3aa09e60ac096b
SHA5128e4980b8b9ce6dfb38741267c01b8a7eaca2ae6512917aeb979f1fcff701e16b15d4bb8ad16c72ecec97b51924795f7aba20039f547172aa9744219711cf7e94
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
memory/1720-19-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1720-38-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1720-20-0x0000000000470000-0x0000000000486000-memory.dmpFilesize
88KB
-
memory/1720-21-0x00000000005F0000-0x0000000000606000-memory.dmpFilesize
88KB
-
memory/1720-22-0x0000000001100000-0x0000000001160000-memory.dmpFilesize
384KB
-
memory/1720-17-0x0000000073F6E000-0x0000000073F6F000-memory.dmpFilesize
4KB
-
memory/1720-18-0x0000000001220000-0x00000000012B2000-memory.dmpFilesize
584KB
-
memory/2180-4-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/2636-25-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-37-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-36-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2636-29-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-31-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-34-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2636-27-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB