Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 12:33

General

  • Target

    89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562.exe

  • Size

    1.1MB

  • MD5

    70af13c890c5081da2091516841af307

  • SHA1

    594f38460e233676ee60e09a0e7bc6e0c4dd2428

  • SHA256

    89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562

  • SHA512

    31104d94f244cb8ad36559f88ce9226733124cfa0db10d286c716c79794695f3e791e9e16622f8741c16c1b3982fd45bd9acf0390ea4cbb6f7f6d062ad73bd8d

  • SSDEEP

    24576:CyNsrxUbbGlC5nHLNyoupccfuC7Px0riP+hniTx1Ej/N5bHFIo:pNskbNxyo3jGx0g+64zND

Malware Config

Extracted

Family

redline

Botnet

horda

C2

194.49.94.152:19053

Extracted

Family

risepro

C2

194.49.94.152

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562.exe
    "C:\Users\Admin\AppData\Local\Temp\89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj6Or14.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj6Or14.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ya0RB62.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ya0RB62.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ig9315.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ig9315.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            5⤵
              PID:1564
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 596
              5⤵
              • Program crash
              PID:5056
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rS28GF.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rS28GF.exe
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1632
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
              5⤵
              • Creates scheduled task(s)
              PID:5032
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
              5⤵
              • Creates scheduled task(s)
              PID:4432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
      1⤵
        PID:4932

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj6Or14.exe

        Filesize

        935KB

        MD5

        f3d3fecc283f8e49955e88d854317dac

        SHA1

        62fefc860b7d771ed0f4438c154afa023b57c08c

        SHA256

        eb300507c0cb513e33ef94544a3bf1af4f33be74a2ca70db2cfd63e858e75f46

        SHA512

        72cd7f7e263123c28804f4c18ab03e0927a571bc1466f2b1b20e222c04d29e3af7d8edb113e0da2f3cac0f892ff09bf09edfbcb9ed2f56b1742f58f9ea204e5f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ya0RB62.exe

        Filesize

        811KB

        MD5

        6acaccecbbe4ea4b2c84bf37b06175bc

        SHA1

        b1108780fde8d55c8c716917f472d4726f609b28

        SHA256

        5a6c444580d38a5947dcd7fdb7a8242bdd49c5dd54977d7058aa9a156d5abc83

        SHA512

        e004cb7ba2b7331f0c9d40e33099c2425390edd75a8232828f311f3093fa298776a73fec98c512bcb07efcd0c046f00f0a1b510aa97ddfa4e5bffa722958df22

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ig9315.exe

        Filesize

        432KB

        MD5

        dc5470255181f2d8c3988607e68e2838

        SHA1

        428a5c0b4cbacce664843c8b8dc853bcdaa42978

        SHA256

        8a6a397ce0ce2f6dffb085e47055049758d8fd637f4f4fd7a5d23d377ad35639

        SHA512

        660cbdc6d8679d2114ce589cde2e9625ac357c6c1546bd2ec6795efc88b5fcb41bad839b84204d142ea1ef38c001b0f77c6cb23567593a38be7c53588d9c6b7d

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3rS28GF.exe

        Filesize

        1.3MB

        MD5

        34563154d1a2a2b7599086eac6ee3913

        SHA1

        21283fbd85cf0372834cd90b29caa4d7d56a7717

        SHA256

        6a9fbce30079f4c2c23ff213b1b7971ae41fa35db94a12db4e11cdaf53d24629

        SHA512

        e785daab62b4b057e83555373ddafb54ef708299ae618c3307ba02536e40897354b042e5214a965daf8500419e684a518606a0eb14215c0aa5a7b607cd066318

      • memory/1564-24-0x0000000001280000-0x000000000128A000-memory.dmp

        Filesize

        40KB

      • memory/1564-23-0x00000000077F0000-0x0000000007882000-memory.dmp

        Filesize

        584KB

      • memory/1564-22-0x0000000007D00000-0x00000000082A4000-memory.dmp

        Filesize

        5.6MB

      • memory/1564-21-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/1564-28-0x00000000088D0000-0x0000000008EE8000-memory.dmp

        Filesize

        6.1MB

      • memory/1564-31-0x0000000007B80000-0x0000000007C8A000-memory.dmp

        Filesize

        1.0MB

      • memory/1564-32-0x00000000078F0000-0x0000000007902000-memory.dmp

        Filesize

        72KB

      • memory/1564-33-0x0000000007AB0000-0x0000000007AEC000-memory.dmp

        Filesize

        240KB

      • memory/1564-34-0x0000000007AF0000-0x0000000007B3C000-memory.dmp

        Filesize

        304KB