Analysis
- max time kernel
125s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/05/2024, 01:58
General
- Target e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5.exe
- Size 3.4MB
- Sample240515-cecbjsbg4y
- SHA256 e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5
Malware Config
Extracted
-
redline
-
cheat
-
91.92.249.99:13359
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 5 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
- Detects executables packed with ConfuserEx Mod 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5.exe"C:\Users\Admin\AppData\Local\Temp\e1dbb4d7308b83fa578a49acb3f8d23b643824ba5626ee3c4b7abd7b6c4f7ac5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\HMC.exe"C:\ProgramData\HMC.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\build.exe"C:\ProgramData\build.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
HMC.exe
build.exe
tmp972.tmp
tmp997.tmp
tmp9C2.tmp
tmp9C8.tmp
tmpA03.tmp
memory/2308-44-0x0000000007DC0000-0x0000000007DDE000-memory.dmp
memory/2308-41-0x0000000007AF0000-0x0000000007CB2000-memory.dmp
memory/2308-32-0x0000000000060000-0x000000000007E000-memory.dmp
memory/2308-33-0x0000000004F20000-0x00000000054C4000-memory.dmp
memory/2308-35-0x0000000004AD0000-0x0000000004B62000-memory.dmp
memory/2308-36-0x0000000004AB0000-0x0000000004AC2000-memory.dmp
memory/2308-34-0x0000000005AF0000-0x0000000006108000-memory.dmp
memory/2308-37-0x0000000005620000-0x000000000565C000-memory.dmp
memory/2308-38-0x0000000005890000-0x00000000058DC000-memory.dmp
memory/2308-39-0x0000000007370000-0x000000000747A000-memory.dmp
memory/2308-45-0x0000000007FC0000-0x0000000008026000-memory.dmp
memory/2308-43-0x00000000079E0000-0x0000000007A56000-memory.dmp
memory/2308-42-0x00000000081F0000-0x000000000871C000-memory.dmp
memory/3340-40-0x00007FFFAC1A0000-0x00007FFFACC61000-memory.dmp
memory/3340-30-0x00007FFFAC1A0000-0x00007FFFACC61000-memory.dmp
memory/3340-27-0x0000000000AC0000-0x0000000000DCC000-memory.dmp
memory/3340-28-0x00007FFFAC1A0000-0x00007FFFACC61000-memory.dmp
memory/5052-29-0x00007FFFAC1A0000-0x00007FFFACC61000-memory.dmp
memory/5052-0-0x00007FFFAC1A3000-0x00007FFFAC1A5000-memory.dmp
memory/5052-2-0x00007FFFAC1A0000-0x00007FFFACC61000-memory.dmp
memory/5052-1-0x0000000000AA0000-0x0000000000E12000-memory.dmp