Analysis
-
max time kernel
268s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:26
Behavioral task
behavioral1
Sample
build.exe
Resource
win10v2004-20240426-en
General
-
Target
build.exe
-
Size
95KB
-
MD5
760bf600ba8eaa08aebfc21f11e84687
-
SHA1
7eb7eb90e2fe67d408c3c93a1881aa35e3c02438
-
SHA256
1d954ce7e83b5ca61bbc81818496749803030ba3c352c0aaac2e4e573fd01493
-
SHA512
4a1d1edea5590260d0c57268399c2dceaf07e6f5ffe82d24ff8095678c4d52513387f851cd8c1335bccf94b4586de7fb54450d7a3ada2bd5c44b3da66830b777
-
SSDEEP
1536:iqseNqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p4:AOCMYk+zi0ZbYe1g0ujyzdq4
Malware Config
Extracted
redline
cheat
memory-intended.gl.at.ply.gg:51752
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4424-1-0x0000000000DE0000-0x0000000000DFE000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4424-1-0x0000000000DE0000-0x0000000000DFE000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
build.exepid process 4424 build.exe 4424 build.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
build.exedescription pid process Token: SeDebugPrivilege 4424 build.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4424-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmpFilesize
4KB
-
memory/4424-1-0x0000000000DE0000-0x0000000000DFE000-memory.dmpFilesize
120KB
-
memory/4424-2-0x0000000005D30000-0x0000000006348000-memory.dmpFilesize
6.1MB
-
memory/4424-3-0x00000000057B0000-0x00000000057C2000-memory.dmpFilesize
72KB
-
memory/4424-4-0x0000000005810000-0x000000000584C000-memory.dmpFilesize
240KB
-
memory/4424-5-0x0000000005850000-0x000000000589C000-memory.dmpFilesize
304KB
-
memory/4424-6-0x0000000074A00000-0x00000000751B0000-memory.dmpFilesize
7.7MB
-
memory/4424-7-0x0000000005AB0000-0x0000000005BBA000-memory.dmpFilesize
1.0MB
-
memory/4424-8-0x0000000006D90000-0x0000000006F52000-memory.dmpFilesize
1.8MB
-
memory/4424-9-0x0000000007490000-0x00000000079BC000-memory.dmpFilesize
5.2MB
-
memory/4424-10-0x0000000006D20000-0x0000000006D86000-memory.dmpFilesize
408KB
-
memory/4424-11-0x0000000007140000-0x00000000071D2000-memory.dmpFilesize
584KB
-
memory/4424-12-0x00000000071E0000-0x0000000007256000-memory.dmpFilesize
472KB
-
memory/4424-13-0x0000000007F70000-0x0000000008514000-memory.dmpFilesize
5.6MB
-
memory/4424-14-0x0000000007360000-0x000000000737E000-memory.dmpFilesize
120KB
-
memory/4424-34-0x0000000074A00000-0x00000000751B0000-memory.dmpFilesize
7.7MB