Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 01:22
Static task
static1
Behavioral task
behavioral1
Sample
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe
Resource
win7-20240221-en
General
-
Target
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe
-
Size
900KB
-
MD5
768ead51112582920104d0f4bb5f0902
-
SHA1
2aab7b0d33e9662af0e8ab9c6f5b3171108efdb5
-
SHA256
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737
-
SHA512
79b22df121afea9f987dda8a14a77c26460db0086881e68ec20587b1c0395ad5432e1ab7d34f50b7eabf6a47c9797d7107e82aeddcaf0c112c117b15b369d11f
-
SSDEEP
12288:pMfqXESqNnb4XKgpwzpZBl+F87bTvrW6C1C0vdXLE38CeWwa6nIz0t2jiCnSGc32:hBqNnb4Xlpir+67b1yCvsJait2uWRRb
Malware Config
Extracted
redline
cheat
45.137.22.186:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-25-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects executables packed with SmartAssembly 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4732-20-0x0000000004E00000-0x0000000004E16000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exePO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation PO.exe -
Executes dropped EXE 2 IoCs
Processes:
PO.exePO.exepid process 4732 PO.exe 3224 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 4732 set thread context of 3224 4732 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PO.exepowershell.exepid process 4732 PO.exe 4732 PO.exe 4732 PO.exe 4732 PO.exe 3848 powershell.exe 3848 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 4732 PO.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeDebugPrivilege 3224 PO.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exePO.exedescription pid process target process PID 1856 wrote to memory of 4732 1856 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 1856 wrote to memory of 4732 1856 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 1856 wrote to memory of 4732 1856 4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe PO.exe PID 4732 wrote to memory of 3848 4732 PO.exe powershell.exe PID 4732 wrote to memory of 3848 4732 PO.exe powershell.exe PID 4732 wrote to memory of 3848 4732 PO.exe powershell.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe PID 4732 wrote to memory of 3224 4732 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe"C:\Users\Admin\AppData\Local\Temp\4fc03c15ef9949cbeb27fadd3b9c65ff798141bcb30590c6e770e79bc8232737.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD511eacbaf9bddbe05b02b6dc4cd9872ea
SHA16e57b21f23521bb174ff36b6e5c8d14924914e9e
SHA25608e026372f53d74354b848cb6ef85b59a0612d67dd993fb77def1fa5355391f1
SHA51299c057a53a0d69b093e359104dda834967e4132f76192e80e79512f465e6fca41325865eec92bca0f11ff4f00c98c185d2d183e56edee964377ea9d4a234961c
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
575KB
MD55e1f47df7bc7d9b80fe2ea5c04855ef4
SHA1dad41763607a024c3c161d6d1a48309d15017328
SHA256589e3616ce7e091b3d4f38ffc5217154fbea5f46ec77f0e7dc3aa09e60ac096b
SHA5128e4980b8b9ce6dfb38741267c01b8a7eaca2ae6512917aeb979f1fcff701e16b15d4bb8ad16c72ecec97b51924795f7aba20039f547172aa9744219711cf7e94
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_12rkupvc.o1b.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3224-49-0x00000000050E0000-0x00000000051EA000-memory.dmpFilesize
1.0MB
-
memory/3224-35-0x0000000004E80000-0x0000000004ECC000-memory.dmpFilesize
304KB
-
memory/3224-34-0x0000000004E40000-0x0000000004E7C000-memory.dmpFilesize
240KB
-
memory/3224-33-0x0000000004DE0000-0x0000000004DF2000-memory.dmpFilesize
72KB
-
memory/3224-32-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/3224-25-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3848-62-0x0000000006A10000-0x0000000006A2E000-memory.dmpFilesize
120KB
-
memory/3848-64-0x0000000007DA0000-0x000000000841A000-memory.dmpFilesize
6.5MB
-
memory/3848-72-0x0000000007A80000-0x0000000007A88000-memory.dmpFilesize
32KB
-
memory/3848-29-0x0000000002A90000-0x0000000002AC6000-memory.dmpFilesize
216KB
-
memory/3848-71-0x0000000007AA0000-0x0000000007ABA000-memory.dmpFilesize
104KB
-
memory/3848-30-0x00000000054E0000-0x0000000005B08000-memory.dmpFilesize
6.2MB
-
memory/3848-70-0x00000000079A0000-0x00000000079B4000-memory.dmpFilesize
80KB
-
memory/3848-69-0x0000000007990000-0x000000000799E000-memory.dmpFilesize
56KB
-
memory/3848-68-0x0000000007960000-0x0000000007971000-memory.dmpFilesize
68KB
-
memory/3848-67-0x00000000079E0000-0x0000000007A76000-memory.dmpFilesize
600KB
-
memory/3848-66-0x00000000077D0000-0x00000000077DA000-memory.dmpFilesize
40KB
-
memory/3848-36-0x0000000005470000-0x0000000005492000-memory.dmpFilesize
136KB
-
memory/3848-38-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/3848-37-0x0000000005BC0000-0x0000000005C26000-memory.dmpFilesize
408KB
-
memory/3848-65-0x0000000007760000-0x000000000777A000-memory.dmpFilesize
104KB
-
memory/3848-48-0x0000000005E00000-0x0000000006154000-memory.dmpFilesize
3.3MB
-
memory/3848-63-0x0000000007630000-0x00000000076D3000-memory.dmpFilesize
652KB
-
memory/3848-50-0x0000000006430000-0x000000000644E000-memory.dmpFilesize
120KB
-
memory/3848-51-0x00000000073F0000-0x0000000007422000-memory.dmpFilesize
200KB
-
memory/3848-52-0x0000000073B30000-0x0000000073B7C000-memory.dmpFilesize
304KB
-
memory/4732-14-0x000000007506E000-0x000000007506F000-memory.dmpFilesize
4KB
-
memory/4732-15-0x0000000000350000-0x00000000003E2000-memory.dmpFilesize
584KB
-
memory/4732-23-0x0000000008BA0000-0x0000000008C3C000-memory.dmpFilesize
624KB
-
memory/4732-16-0x00000000051D0000-0x0000000005774000-memory.dmpFilesize
5.6MB
-
memory/4732-17-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/4732-18-0x0000000004CB0000-0x0000000004CBA000-memory.dmpFilesize
40KB
-
memory/4732-19-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4732-31-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/4732-20-0x0000000004E00000-0x0000000004E16000-memory.dmpFilesize
88KB
-
memory/4732-21-0x00000000051C0000-0x00000000051D6000-memory.dmpFilesize
88KB
-
memory/4732-22-0x0000000006540000-0x00000000065A0000-memory.dmpFilesize
384KB