Overview
overview
10Static
static
566ecdd9e82...96.exe
windows7-x64
1066ecdd9e82...96.exe
windows10-2004-x64
1088b889a147...73.exe
windows7-x64
1088b889a147...73.exe
windows10-2004-x64
10a0527f548f...67.exe
windows7-x64
10a0527f548f...67.exe
windows10-2004-x64
10e2ea3676e2...d2.exe
windows7-x64
10e2ea3676e2...d2.exe
windows10-2004-x64
10f419ddfc11...08.exe
windows7-x64
10f419ddfc11...08.exe
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 01:02
Static task
static1
Behavioral task
behavioral1
Sample
66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66ecdd9e82e6b829dc44e8eb897064793cc40509207d0e6e2db611ff0b2f3696.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
a0527f548f6ed392f4d578d32ce5d75677492875b13a60a068e55f8ad6105267.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
e2ea3676e2e980745eda749615e7dc0be91e60f7fb98bb553ba0ad32a36504d2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
f419ddfc11a334a5ab4f9a289db5783877d4108107ed912e2e2b3f57ae9be808.exe
Resource
win7-20240611-en
General
-
Target
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe
-
Size
809KB
-
MD5
15f948da0e0786ee883bc9714ee6b47a
-
SHA1
13d0747a12ce2783ac3a1d225d760cd5b2ed1aa1
-
SHA256
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573
-
SHA512
006913022a08797087c1a47e89f1fba3beef5eb7f925631d507e841f361b56fe7dbefa1a1a60c0f5542742ad71c0b142ab5f4d280bfd9bc50bf5f7018c6bb31e
-
SSDEEP
24576:aJr8tE+sQJRRGM3sU+7sdCGNcArcotgiko7ehxaFpmx9:aJ4LP1MsdV5c+g5OiaFM/
Malware Config
Extracted
redline
cheat
45.137.22.68:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/3432-43-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/3432-43-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2352 powershell.exe 412 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO.exe88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation PO.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe -
Executes dropped EXE 3 IoCs
Processes:
PO.exePO.exePO.exepid process 1164 PO.exe 2592 PO.exe 3432 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 1164 set thread context of 3432 1164 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
PO.exepowershell.exepowershell.exepid process 1164 PO.exe 1164 PO.exe 1164 PO.exe 2352 powershell.exe 2352 powershell.exe 1164 PO.exe 1164 PO.exe 412 powershell.exe 412 powershell.exe 1164 PO.exe 1164 PO.exe 2352 powershell.exe 412 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 1164 PO.exe Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 412 powershell.exe Token: SeDebugPrivilege 3432 PO.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exePO.exedescription pid process target process PID 3164 wrote to memory of 1164 3164 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 3164 wrote to memory of 1164 3164 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 3164 wrote to memory of 1164 3164 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 1164 wrote to memory of 2352 1164 PO.exe powershell.exe PID 1164 wrote to memory of 2352 1164 PO.exe powershell.exe PID 1164 wrote to memory of 2352 1164 PO.exe powershell.exe PID 1164 wrote to memory of 412 1164 PO.exe powershell.exe PID 1164 wrote to memory of 412 1164 PO.exe powershell.exe PID 1164 wrote to memory of 412 1164 PO.exe powershell.exe PID 1164 wrote to memory of 4652 1164 PO.exe schtasks.exe PID 1164 wrote to memory of 4652 1164 PO.exe schtasks.exe PID 1164 wrote to memory of 4652 1164 PO.exe schtasks.exe PID 1164 wrote to memory of 2592 1164 PO.exe PO.exe PID 1164 wrote to memory of 2592 1164 PO.exe PO.exe PID 1164 wrote to memory of 2592 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe PID 1164 wrote to memory of 3432 1164 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A09.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4416,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:81⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD5b7b9acb869ccc7f7ecb5304ec0384dee
SHA16a90751c95817903ee833d59a0abbef425a613b3
SHA2568cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA5127bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
716KB
MD56da58e4a005e57e0eee2faf662dfd4ae
SHA12146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0xtgit14.ra0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp2A09.tmpFilesize
1KB
MD585e524cb1aac2e74fdd85af360903ff4
SHA1309791f6a363bfa30114e431dac57ce72c8ab741
SHA25657e799276e47aa1118575267b09f39424165ce815ebf47c9d5ec9a1a708039af
SHA51222ea22681c737f28a123568781d927b936356d9015b3b2d9a40ef8b7e8835809dca308c696bf50e05358f2167b36b01d2d293ce0d5f688872fe22f54eae6b22d
-
memory/412-97-0x0000000007E10000-0x0000000007E2A000-memory.dmpFilesize
104KB
-
memory/412-96-0x0000000007D10000-0x0000000007D24000-memory.dmpFilesize
80KB
-
memory/412-93-0x0000000007D50000-0x0000000007DE6000-memory.dmpFilesize
600KB
-
memory/412-80-0x000000006FA60000-0x000000006FAAC000-memory.dmpFilesize
304KB
-
memory/1164-24-0x0000000006CB0000-0x0000000006D10000-memory.dmpFilesize
384KB
-
memory/1164-18-0x00000000052A0000-0x00000000055F4000-memory.dmpFilesize
3.3MB
-
memory/1164-22-0x0000000006C70000-0x0000000006C7E000-memory.dmpFilesize
56KB
-
memory/1164-25-0x00000000093A0000-0x000000000943C000-memory.dmpFilesize
624KB
-
memory/1164-21-0x0000000006C50000-0x0000000006C66000-memory.dmpFilesize
88KB
-
memory/1164-14-0x00000000726CE000-0x00000000726CF000-memory.dmpFilesize
4KB
-
memory/1164-15-0x0000000000730000-0x00000000007E4000-memory.dmpFilesize
720KB
-
memory/1164-20-0x0000000005D60000-0x0000000005D6A000-memory.dmpFilesize
40KB
-
memory/1164-16-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/1164-23-0x0000000006C80000-0x0000000006C90000-memory.dmpFilesize
64KB
-
memory/1164-19-0x00000000726C0000-0x0000000072E70000-memory.dmpFilesize
7.7MB
-
memory/1164-17-0x0000000005200000-0x0000000005292000-memory.dmpFilesize
584KB
-
memory/1164-59-0x00000000726C0000-0x0000000072E70000-memory.dmpFilesize
7.7MB
-
memory/2352-79-0x0000000006C20000-0x0000000006CC3000-memory.dmpFilesize
652KB
-
memory/2352-34-0x0000000004A40000-0x0000000004A62000-memory.dmpFilesize
136KB
-
memory/2352-98-0x0000000007030000-0x0000000007038000-memory.dmpFilesize
32KB
-
memory/2352-31-0x00000000020E0000-0x0000000002116000-memory.dmpFilesize
216KB
-
memory/2352-32-0x0000000004B50000-0x0000000005178000-memory.dmpFilesize
6.2MB
-
memory/2352-95-0x0000000006F40000-0x0000000006F4E000-memory.dmpFilesize
56KB
-
memory/2352-65-0x00000000059F0000-0x0000000005A0E000-memory.dmpFilesize
120KB
-
memory/2352-94-0x0000000006F10000-0x0000000006F21000-memory.dmpFilesize
68KB
-
memory/2352-68-0x000000006FA60000-0x000000006FAAC000-memory.dmpFilesize
304KB
-
memory/2352-67-0x0000000006030000-0x0000000006062000-memory.dmpFilesize
200KB
-
memory/2352-78-0x0000000005FB0000-0x0000000005FCE000-memory.dmpFilesize
120KB
-
memory/2352-35-0x0000000004AE0000-0x0000000004B46000-memory.dmpFilesize
408KB
-
memory/2352-36-0x0000000005280000-0x00000000052E6000-memory.dmpFilesize
408KB
-
memory/2352-90-0x0000000007350000-0x00000000079CA000-memory.dmpFilesize
6.5MB
-
memory/2352-91-0x0000000006D10000-0x0000000006D2A000-memory.dmpFilesize
104KB
-
memory/2352-92-0x0000000006D80000-0x0000000006D8A000-memory.dmpFilesize
40KB
-
memory/3432-43-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3432-66-0x0000000005AE0000-0x0000000005BEA000-memory.dmpFilesize
1.0MB
-
memory/3432-64-0x0000000005870000-0x00000000058BC000-memory.dmpFilesize
304KB
-
memory/3432-63-0x0000000005830000-0x000000000586C000-memory.dmpFilesize
240KB
-
memory/3432-62-0x00000000057D0000-0x00000000057E2000-memory.dmpFilesize
72KB
-
memory/3432-61-0x0000000005F30000-0x0000000006548000-memory.dmpFilesize
6.1MB