Analysis
-
max time kernel
131s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 17:44
Static task
static1
Behavioral task
behavioral1
Sample
D2.exe
Resource
win7-20240220-en
General
-
Target
D2.exe
-
Size
1.2MB
-
MD5
257e39d3303af1aeb617348d24f6fd6d
-
SHA1
312a83b35ecb90068d845736b85157d4832c5224
-
SHA256
79c1b2807322559ab1996ef9f704a4ae213d0b282c5f3972862eb1039a54edde
-
SHA512
d88ff532f4e396ffef520f6f0ab7c9711cfe25c4cfd2e3ba84f7a8de6fc2d94942c54f66c467037d0000852b8539974b8d43c7ca754b012e6472b2d1eee9cd0b
-
SSDEEP
24576:/KxiiAH280V6GfVDeRzFZMskrfQDmUx5Da1adHJFsF:/KAOV6GfVDePey7pdJFsF
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral2/memory/940-1-0x0000000000400000-0x000000000044A000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/940-1-0x0000000000400000-0x000000000044A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
D2.exedescription pid process target process PID 3576 set thread context of 940 3576 D2.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 940 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 940 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
D2.exedescription pid process target process PID 3576 wrote to memory of 4600 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 4600 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 4600 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe PID 3576 wrote to memory of 940 3576 D2.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D2.exe"C:\Users\Admin\AppData\Local\Temp\D2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4600
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/940-10-0x00000000067B0000-0x00000000067C2000-memory.dmpFilesize
72KB
-
memory/940-4-0x0000000005D60000-0x0000000006304000-memory.dmpFilesize
5.6MB
-
memory/940-21-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/940-12-0x0000000006990000-0x00000000069DC000-memory.dmpFilesize
304KB
-
memory/940-11-0x0000000006810000-0x000000000684C000-memory.dmpFilesize
240KB
-
memory/940-5-0x00000000056F0000-0x0000000005782000-memory.dmpFilesize
584KB
-
memory/940-6-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/940-7-0x00000000058A0000-0x00000000058AA000-memory.dmpFilesize
40KB
-
memory/940-8-0x0000000006D30000-0x0000000007348000-memory.dmpFilesize
6.1MB
-
memory/940-9-0x0000000006880000-0x000000000698A000-memory.dmpFilesize
1.0MB
-
memory/940-1-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/940-19-0x0000000074EC0000-0x0000000075670000-memory.dmpFilesize
7.7MB
-
memory/940-3-0x0000000074ECE000-0x0000000074ECF000-memory.dmpFilesize
4KB
-
memory/940-13-0x0000000006B10000-0x0000000006B76000-memory.dmpFilesize
408KB
-
memory/940-14-0x00000000074D0000-0x0000000007546000-memory.dmpFilesize
472KB
-
memory/940-15-0x0000000006CF0000-0x0000000006D0E000-memory.dmpFilesize
120KB
-
memory/940-16-0x0000000008270000-0x0000000008432000-memory.dmpFilesize
1.8MB
-
memory/940-17-0x0000000009170000-0x000000000969C000-memory.dmpFilesize
5.2MB
-
memory/940-18-0x0000000074ECE000-0x0000000074ECF000-memory.dmpFilesize
4KB
-
memory/3576-2-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/3576-0-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB