Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/06/2024, 06:33
General
- Target 88fa009b7c0bbe55a3f19c0cf82fb39637eb76200257b932048081eec6a83832.exe
- Size 806KB
- Sample240604-hbfgpagc3z
- SHA256 88fa009b7c0bbe55a3f19c0cf82fb39637eb76200257b932048081eec6a83832
Malware Config
Extracted
-
redline
-
cheat
-
45.137.22.68:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88fa009b7c0bbe55a3f19c0cf82fb39637eb76200257b932048081eec6a83832.exe"C:\Users\Admin\AppData\Local\Temp\88fa009b7c0bbe55a3f19c0cf82fb39637eb76200257b932048081eec6a83832.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PVYlvkPfBmw.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PVYlvkPfBmw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8750.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PO.exe.log
StartupProfileData-NonInteractive
PO.exe
PO.jpg
__PSScriptPolicyTest_rcokx2rv.5un.ps1
tmp8750.tmp
tmpA53A.tmp
tmpA55F.tmp
tmpA58A.tmp
tmpA590.tmp
tmpA5A6.tmp
tmpA5C1.tmp
memory/1488-95-0x0000000007EB0000-0x0000000007EC4000-memory.dmp
memory/1488-94-0x0000000007EA0000-0x0000000007EAE000-memory.dmp
memory/1488-92-0x0000000007EF0000-0x0000000007F86000-memory.dmp
memory/1488-97-0x0000000007F90000-0x0000000007F98000-memory.dmp
memory/1488-89-0x00000000082C0000-0x000000000893A000-memory.dmp
memory/1488-88-0x0000000007B40000-0x0000000007BE3000-memory.dmp
memory/1488-73-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/2828-25-0x0000000009330000-0x00000000093CC000-memory.dmp
memory/2828-24-0x0000000006C50000-0x0000000006CB0000-memory.dmp
memory/2828-14-0x00000000733EE000-0x00000000733EF000-memory.dmp
memory/2828-15-0x0000000000840000-0x00000000008DC000-memory.dmp
memory/2828-58-0x00000000733E0000-0x0000000073B90000-memory.dmp
memory/2828-16-0x00000000055F0000-0x0000000005B94000-memory.dmp
memory/2828-17-0x0000000005130000-0x00000000051C2000-memory.dmp
memory/2828-18-0x0000000005BA0000-0x0000000005EF4000-memory.dmp
memory/2828-19-0x00000000733E0000-0x0000000073B90000-memory.dmp
memory/2828-20-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/2828-21-0x00000000055D0000-0x00000000055E6000-memory.dmp
memory/2828-22-0x0000000006C10000-0x0000000006C1E000-memory.dmp
memory/2828-23-0x0000000006C20000-0x0000000006C30000-memory.dmp
memory/3060-64-0x0000000005B90000-0x0000000005BDC000-memory.dmp
memory/3060-93-0x0000000007080000-0x0000000007091000-memory.dmp
memory/3060-32-0x0000000004E90000-0x00000000054B8000-memory.dmp
memory/3060-31-0x0000000002260000-0x0000000002296000-memory.dmp
memory/3060-90-0x0000000006E80000-0x0000000006E9A000-memory.dmp
memory/3060-91-0x0000000006EF0000-0x0000000006EFA000-memory.dmp
memory/3060-86-0x0000000006100000-0x000000000611E000-memory.dmp
memory/3060-62-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/3060-35-0x0000000004CA0000-0x0000000004D06000-memory.dmp
memory/3060-66-0x0000000006120000-0x0000000006152000-memory.dmp
memory/3060-96-0x00000000071C0000-0x00000000071DA000-memory.dmp
memory/3060-67-0x000000006FED0000-0x000000006FF1C000-memory.dmp
memory/3060-33-0x0000000004B90000-0x0000000004BB2000-memory.dmp
memory/3060-34-0x0000000004C30000-0x0000000004C96000-memory.dmp
memory/3108-65-0x0000000005840000-0x000000000594A000-memory.dmp
memory/3108-104-0x0000000007160000-0x00000000071D6000-memory.dmp
memory/3108-105-0x0000000007750000-0x000000000776E000-memory.dmp
memory/3108-63-0x00000000055A0000-0x00000000055DC000-memory.dmp
memory/3108-103-0x0000000007220000-0x000000000774C000-memory.dmp
memory/3108-61-0x0000000005540000-0x0000000005552000-memory.dmp
memory/3108-60-0x0000000005AF0000-0x0000000006108000-memory.dmp
memory/3108-102-0x0000000006B20000-0x0000000006CE2000-memory.dmp
memory/3108-55-0x0000000000400000-0x000000000041E000-memory.dmp