Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 21:11
Static task
static1
Behavioral task
behavioral1
Sample
4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe
Resource
win7-20240221-en
General
-
Target
4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe
-
Size
834KB
-
MD5
2a13bd0e8247f4e3b4b92e2248171ef6
-
SHA1
a5252c5b3aac0afda1fe76d1ec6339bb994ec9ce
-
SHA256
4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e
-
SHA512
d598ff6aa5bf9ad5a1e6fba0a2df72cc7e43589c7e77c753efc00ec4ab97131e4ffcc0289dc8339c881b95357328213bc6ac518f71e4118714e8ea87e8b3768e
-
SSDEEP
12288:bCf0rGLDrU1qBBuE+juhnS6/fRRCRdXcue9NNqo5TzIuYJhi9OKtqAOU80tZqoCh:bCdL4E+j8SmRRahe9NLr9ONAdy/IXi
Malware Config
Extracted
redline
cheat
185.222.58.70:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5100-40-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5100-40-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5100-40-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects executables packed with SmartAssembly 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1188-21-0x0000000005B60000-0x0000000005B70000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/1188-22-0x0000000007230000-0x000000000723C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3336 powershell.exe 4168 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exePO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation PO.exe -
Executes dropped EXE 4 IoCs
Processes:
PO.exePO.exePO.exePO.exepid process 1188 PO.exe 3780 PO.exe 3296 PO.exe 5100 PO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 1188 set thread context of 5100 1188 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exepid process 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 1188 PO.exe 3336 powershell.exe 3336 powershell.exe 4168 powershell.exe 4168 powershell.exe 1188 PO.exe 4168 powershell.exe 3336 powershell.exe 5100 PO.exe 5100 PO.exe 5100 PO.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 1188 PO.exe Token: SeDebugPrivilege 3336 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 5100 PO.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exePO.exedescription pid process target process PID 4752 wrote to memory of 1188 4752 4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe PO.exe PID 4752 wrote to memory of 1188 4752 4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe PO.exe PID 4752 wrote to memory of 1188 4752 4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe PO.exe PID 1188 wrote to memory of 3336 1188 PO.exe powershell.exe PID 1188 wrote to memory of 3336 1188 PO.exe powershell.exe PID 1188 wrote to memory of 3336 1188 PO.exe powershell.exe PID 1188 wrote to memory of 4168 1188 PO.exe powershell.exe PID 1188 wrote to memory of 4168 1188 PO.exe powershell.exe PID 1188 wrote to memory of 4168 1188 PO.exe powershell.exe PID 1188 wrote to memory of 4424 1188 PO.exe schtasks.exe PID 1188 wrote to memory of 4424 1188 PO.exe schtasks.exe PID 1188 wrote to memory of 4424 1188 PO.exe schtasks.exe PID 1188 wrote to memory of 3780 1188 PO.exe PO.exe PID 1188 wrote to memory of 3780 1188 PO.exe PO.exe PID 1188 wrote to memory of 3780 1188 PO.exe PO.exe PID 1188 wrote to memory of 3296 1188 PO.exe PO.exe PID 1188 wrote to memory of 3296 1188 PO.exe PO.exe PID 1188 wrote to memory of 3296 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe PID 1188 wrote to memory of 5100 1188 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe"C:\Users\Admin\AppData\Local\Temp\4968fd74d0eca2ecfb169c87dd8008181abe551ca91c7396c765fd67f588815e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KqWcrEQbkVyaIO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KqWcrEQbkVyaIO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF94.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD531f95c36ee4b5ac1ffcbdc89b3bcabc0
SHA1d38fddab78283c1cc05cc55652222cd7e5a484aa
SHA25688486792973340aafc9db775eadfaa849d05a5e2ed25a38e67febcdf70213ce6
SHA5129acb665346143d8622613d047502a65615ea369db94281b20cb5bea6dac18f397f8c0144e8d4a201d94cd36b229ad9a31ce4a4a11e1fdcd19e6496a035032072
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
589KB
MD526afbb9dcfc34b21455b5af126c1bf9e
SHA1ed732bf6ed3fd98ec70d1ed3ebe7d44a00df582e
SHA2569b19e722aed6ca589d2d433cdceaf462c2d30c26916a9b3bbab7e8ed8c1ed78e
SHA512da99c06b0647687de9eafd12468dc0cb27896692b99d842cba7a63229904d82a7cc753552abe82734b8143b03d7ea9df166bf8d8e3a7784c77184e8c9bb9698f
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svi5zzih.0xl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp6F2C.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp6FBF.tmpFilesize
92KB
MD54c2e2189b87f507edc2e72d7d55583a0
SHA11f06e340f76d41ea0d1e8560acd380a901b2a5bd
SHA25699a5f8dea08b5cf512ed888b3e533cc77c08dc644078793dc870abd8828c1bca
SHA5128b6b49e55afe8a697aaf71d975fab9e906143339827f75a57876a540d0d7b9e3cbbcdd8b5435d6198900a73895cc52d2082e66ee8cec342e72f2e427dde71600
-
C:\Users\Admin\AppData\Local\Temp\tmp71AF.tmpFilesize
56KB
MD5d444c807029c83b8a892ac0c4971f955
SHA1fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA2568297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e
-
C:\Users\Admin\AppData\Local\Temp\tmp71C5.tmpFilesize
220KB
MD5485905d27532ac3aa5e05dee8c7c00ae
SHA10dda0f58edb73efeb09fd983c62e75babd67f070
SHA256a5696756dfd836fc8ac1923d8ba964a084e6ad9508169499449dbd755828ae03
SHA512cafeb4036421c0ed67e87e4b1ef10e953d528681d3d1c2ea7da0724100c6d3c1d4f02ff71293b880ce5a5008989ae9c9b83dea5d20557397c521017866b47990
-
C:\Users\Admin\AppData\Local\Temp\tmp7200.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Local\Temp\tmpAF94.tmpFilesize
1KB
MD5c6cb07bcb15c1dd2310cc7a2093c8d78
SHA13ec0697676aeda9e36f1a0d0cc14dfa5cfb2d4ab
SHA256982af7a9f5de6e8506444c05132c30193f6cb61f07c14402d031b8e43c5f0a7e
SHA512579c9e1ebe1c1187b73d9779177531e7e650d57b84044b27c757a233e9266990e692ce71d9ee676ddc8e6b0f1b77dec99e5174d4d7b2ffbd9313a2c9581cd93a
-
memory/1188-24-0x00000000072E0000-0x000000000737C000-memory.dmpFilesize
624KB
-
memory/1188-19-0x0000000005860000-0x000000000586A000-memory.dmpFilesize
40KB
-
memory/1188-14-0x000000007335E000-0x000000007335F000-memory.dmpFilesize
4KB
-
memory/1188-27-0x0000000073350000-0x0000000073B00000-memory.dmpFilesize
7.7MB
-
memory/1188-23-0x0000000007490000-0x00000000074F0000-memory.dmpFilesize
384KB
-
memory/1188-15-0x0000000000D70000-0x0000000000E04000-memory.dmpFilesize
592KB
-
memory/1188-22-0x0000000007230000-0x000000000723C000-memory.dmpFilesize
48KB
-
memory/1188-16-0x0000000005780000-0x0000000005812000-memory.dmpFilesize
584KB
-
memory/1188-17-0x0000000005F10000-0x00000000064B4000-memory.dmpFilesize
5.6MB
-
memory/1188-25-0x000000007335E000-0x000000007335F000-memory.dmpFilesize
4KB
-
memory/1188-18-0x0000000073350000-0x0000000073B00000-memory.dmpFilesize
7.7MB
-
memory/1188-21-0x0000000005B60000-0x0000000005B70000-memory.dmpFilesize
64KB
-
memory/1188-44-0x0000000073350000-0x0000000073B00000-memory.dmpFilesize
7.7MB
-
memory/1188-20-0x0000000007180000-0x00000000071F0000-memory.dmpFilesize
448KB
-
memory/3336-37-0x00000000055C0000-0x0000000005626000-memory.dmpFilesize
408KB
-
memory/3336-83-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/3336-65-0x0000000005FD0000-0x0000000006324000-memory.dmpFilesize
3.3MB
-
memory/3336-241-0x0000000007AA0000-0x0000000007ABA000-memory.dmpFilesize
104KB
-
memory/3336-239-0x0000000007A90000-0x0000000007A9E000-memory.dmpFilesize
56KB
-
memory/3336-68-0x0000000005EA0000-0x0000000005EBE000-memory.dmpFilesize
120KB
-
memory/3336-242-0x0000000007820000-0x0000000007828000-memory.dmpFilesize
32KB
-
memory/3336-71-0x0000000006A80000-0x0000000006AB2000-memory.dmpFilesize
200KB
-
memory/3336-26-0x0000000002B50000-0x0000000002B86000-memory.dmpFilesize
216KB
-
memory/3336-30-0x0000000005660000-0x0000000005C88000-memory.dmpFilesize
6.2MB
-
memory/3336-72-0x0000000075BA0000-0x0000000075BEC000-memory.dmpFilesize
304KB
-
memory/3336-101-0x0000000007A60000-0x0000000007A71000-memory.dmpFilesize
68KB
-
memory/3336-93-0x0000000006AC0000-0x0000000006B63000-memory.dmpFilesize
652KB
-
memory/3336-35-0x0000000005210000-0x0000000005232000-memory.dmpFilesize
136KB
-
memory/3336-36-0x0000000005550000-0x00000000055B6000-memory.dmpFilesize
408KB
-
memory/4168-96-0x0000000007C30000-0x0000000007C3A000-memory.dmpFilesize
40KB
-
memory/4168-95-0x0000000006E30000-0x0000000006E4A000-memory.dmpFilesize
104KB
-
memory/4168-94-0x0000000008200000-0x000000000887A000-memory.dmpFilesize
6.5MB
-
memory/4168-100-0x0000000007E20000-0x0000000007EB6000-memory.dmpFilesize
600KB
-
memory/4168-240-0x0000000007BC0000-0x0000000007BD4000-memory.dmpFilesize
80KB
-
memory/4168-78-0x0000000075BA0000-0x0000000075BEC000-memory.dmpFilesize
304KB
-
memory/4168-70-0x0000000006EA0000-0x0000000006ED2000-memory.dmpFilesize
200KB
-
memory/5100-66-0x0000000005170000-0x00000000051AC000-memory.dmpFilesize
240KB
-
memory/5100-105-0x0000000006DB0000-0x0000000006DCE000-memory.dmpFilesize
120KB
-
memory/5100-102-0x0000000006BD0000-0x0000000006C46000-memory.dmpFilesize
472KB
-
memory/5100-99-0x0000000006DE0000-0x000000000730C000-memory.dmpFilesize
5.2MB
-
memory/5100-97-0x00000000066E0000-0x00000000068A2000-memory.dmpFilesize
1.8MB
-
memory/5100-69-0x0000000005400000-0x000000000550A000-memory.dmpFilesize
1.0MB
-
memory/5100-67-0x00000000051B0000-0x00000000051FC000-memory.dmpFilesize
304KB
-
memory/5100-58-0x0000000005100000-0x0000000005112000-memory.dmpFilesize
72KB
-
memory/5100-55-0x0000000005750000-0x0000000005D68000-memory.dmpFilesize
6.1MB
-
memory/5100-40-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB