Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/05/2024, 11:32
General
- Target 38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe
- Size 569KB
- Sample240515-nngheafe45
- SHA256 38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68
Malware Config
Extracted
-
redline
-
National
-
185.216.70.15:65012
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe"C:\Users\Admin\AppData\Local\Temp\38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe"C:\Users\Admin\AppData\Local\Temp\38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
38c705a8dd3a80a55f20d881ce5e6c848201ba129ef8a8ba990cc3899d5b2a68.exe.log
__PSScriptPolicyTest_mfcmx23i.kpd.ps1
tmpB17E.tmp
tmpB194.tmp
tmpB1CF.tmp
tmpB1D5.tmp
tmpB1EA.tmp
tmpB216.tmp
memory/632-32-0x0000000005770000-0x00000000057BC000-memory.dmp
memory/632-38-0x00000000059D0000-0x0000000005ADA000-memory.dmp
memory/632-66-0x00000000073B0000-0x00000000078DC000-memory.dmp
memory/632-11-0x0000000000400000-0x000000000041E000-memory.dmp
memory/632-67-0x0000000007100000-0x0000000007176000-memory.dmp
memory/632-68-0x0000000007390000-0x00000000073AE000-memory.dmp
memory/632-22-0x0000000005730000-0x000000000576C000-memory.dmp
memory/632-247-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/632-65-0x0000000006CB0000-0x0000000006E72000-memory.dmp
memory/632-16-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/632-31-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/632-19-0x0000000005C10000-0x0000000006228000-memory.dmp
memory/632-21-0x0000000005690000-0x00000000056A2000-memory.dmp
memory/3040-5-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/3040-9-0x00000000061E0000-0x00000000061F6000-memory.dmp
memory/3040-4-0x0000000004EF0000-0x0000000004EFA000-memory.dmp
memory/3040-3-0x0000000004E30000-0x0000000004EC2000-memory.dmp
memory/3040-6-0x0000000005110000-0x00000000051AC000-memory.dmp
memory/3040-8-0x00000000060A0000-0x00000000060B0000-memory.dmp
memory/3040-2-0x00000000053E0000-0x0000000005984000-memory.dmp
memory/3040-1-0x00000000003C0000-0x0000000000450000-memory.dmp
memory/3040-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/3040-7-0x00000000053C0000-0x00000000053DE000-memory.dmp
memory/3040-13-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/3040-10-0x00000000068E0000-0x0000000006940000-memory.dmp
memory/3704-15-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/3704-52-0x00000000073C0000-0x0000000007463000-memory.dmp
memory/3704-53-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/3704-54-0x0000000007500000-0x000000000751A000-memory.dmp
memory/3704-55-0x0000000007570000-0x000000000757A000-memory.dmp
memory/3704-56-0x0000000007780000-0x0000000007816000-memory.dmp
memory/3704-57-0x0000000007700000-0x0000000007711000-memory.dmp
memory/3704-58-0x0000000007730000-0x000000000773E000-memory.dmp
memory/3704-59-0x0000000007740000-0x0000000007754000-memory.dmp
memory/3704-60-0x0000000007840000-0x000000000785A000-memory.dmp
memory/3704-61-0x0000000007820000-0x0000000007828000-memory.dmp
memory/3704-64-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/3704-51-0x0000000006780000-0x000000000679E000-memory.dmp
memory/3704-41-0x0000000071080000-0x00000000710CC000-memory.dmp
memory/3704-40-0x00000000067A0000-0x00000000067D2000-memory.dmp
memory/3704-39-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/3704-33-0x0000000005C60000-0x0000000005FB4000-memory.dmp
memory/3704-23-0x0000000005130000-0x0000000005152000-memory.dmp
memory/3704-25-0x0000000005240000-0x00000000052A6000-memory.dmp
memory/3704-24-0x00000000051D0000-0x0000000005236000-memory.dmp
memory/3704-20-0x0000000005530000-0x0000000005B58000-memory.dmp
memory/3704-17-0x0000000074E50000-0x0000000074EFB000-memory.dmp
memory/3704-18-0x00000000028B0000-0x00000000028E6000-memory.dmp