Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-07-2024 01:58

General

  • Target

    c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe

  • Size

    713KB

  • MD5

    3599fa63d78413242a88966d3b4b14ef

  • SHA1

    44526b00e847d9a16908c79f72dab1af4a2edf29

  • SHA256

    c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33

  • SHA512

    e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73

  • SSDEEP

    12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.58.91:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
    "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4536
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TmfmVKU.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:532
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA74C.tmp"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3268
    • C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
      "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe.log

    Filesize

    1KB

    MD5

    8ec831f3e3a3f77e4a7b9cd32b48384c

    SHA1

    d83f09fd87c5bd86e045873c231c14836e76a05c

    SHA256

    7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

    SHA512

    26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    1ca509e2002f355e9a8df749587c2725

    SHA1

    fa0fa9cb50008531af3efbc358ffa549f378d161

    SHA256

    575fdf32932d68763dd2029b01225bf8c9c766e48147fe5a35576279838ef596

    SHA512

    f283ba2a06f11fa2c187da896a7d6c5b7b25261b6937bfd06ab7842b62d20430ab2a7ee99f4e31a5624d9795c6c8d53366eae672a037d5ee568d59bdaeb3a59a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50e3k2qd.xdd.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpA74C.tmp

    Filesize

    1KB

    MD5

    93ac04fd618b144f6d3b910e4d762a39

    SHA1

    9c456a67518961fe82ac3a623ad67c43e4a5d863

    SHA256

    4c5b5b6b62658fa8e7bc0e621227be600073027d135334564daeea85a143aa2b

    SHA512

    4f2298e1cd41f320c4331cc5483d6cd96aec66e81bd9a1375c553adc43a2047d0354d8bcbc1f1f933dc0c60024438db3576e77dbb9cd667c9c121d1849c637eb

  • memory/532-44-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/532-19-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/532-69-0x0000000075750000-0x000000007579C000-memory.dmp

    Filesize

    304KB

  • memory/532-82-0x00000000078E0000-0x0000000007976000-memory.dmp

    Filesize

    600KB

  • memory/532-84-0x0000000007890000-0x000000000789E000-memory.dmp

    Filesize

    56KB

  • memory/532-33-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/532-85-0x00000000078A0000-0x00000000078B4000-memory.dmp

    Filesize

    80KB

  • memory/532-94-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/532-86-0x00000000079A0000-0x00000000079BA000-memory.dmp

    Filesize

    104KB

  • memory/1904-96-0x00000000070F0000-0x000000000761C000-memory.dmp

    Filesize

    5.2MB

  • memory/1904-51-0x0000000005A30000-0x0000000006048000-memory.dmp

    Filesize

    6.1MB

  • memory/1904-54-0x0000000005470000-0x00000000054AC000-memory.dmp

    Filesize

    240KB

  • memory/1904-95-0x00000000069F0000-0x0000000006BB2000-memory.dmp

    Filesize

    1.8MB

  • memory/1904-53-0x0000000005410000-0x0000000005422000-memory.dmp

    Filesize

    72KB

  • memory/1904-46-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/1904-55-0x0000000005710000-0x000000000581A000-memory.dmp

    Filesize

    1.0MB

  • memory/3508-9-0x0000000008020000-0x00000000080BC000-memory.dmp

    Filesize

    624KB

  • memory/3508-4-0x0000000004F40000-0x0000000004F4A000-memory.dmp

    Filesize

    40KB

  • memory/3508-2-0x0000000005540000-0x0000000005AE4000-memory.dmp

    Filesize

    5.6MB

  • memory/3508-34-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

    Filesize

    4KB

  • memory/3508-3-0x0000000004F90000-0x0000000005022000-memory.dmp

    Filesize

    584KB

  • memory/3508-48-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/3508-1-0x0000000000480000-0x0000000000534000-memory.dmp

    Filesize

    720KB

  • memory/3508-8-0x00000000054E0000-0x0000000005540000-memory.dmp

    Filesize

    384KB

  • memory/3508-7-0x00000000053C0000-0x00000000053CC000-memory.dmp

    Filesize

    48KB

  • memory/3508-6-0x00000000053A0000-0x00000000053B0000-memory.dmp

    Filesize

    64KB

  • memory/3508-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

    Filesize

    4KB

  • memory/3508-5-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-16-0x0000000005980000-0x0000000005FA8000-memory.dmp

    Filesize

    6.2MB

  • memory/4536-67-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

    Filesize

    120KB

  • memory/4536-57-0x0000000075750000-0x000000007579C000-memory.dmp

    Filesize

    304KB

  • memory/4536-52-0x0000000006E10000-0x0000000006E5C000-memory.dmp

    Filesize

    304KB

  • memory/4536-68-0x0000000007AA0000-0x0000000007B43000-memory.dmp

    Filesize

    652KB

  • memory/4536-56-0x0000000007860000-0x0000000007892000-memory.dmp

    Filesize

    200KB

  • memory/4536-79-0x00000000081D0000-0x000000000884A000-memory.dmp

    Filesize

    6.5MB

  • memory/4536-80-0x0000000007B70000-0x0000000007B8A000-memory.dmp

    Filesize

    104KB

  • memory/4536-81-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

    Filesize

    40KB

  • memory/4536-50-0x0000000006830000-0x000000000684E000-memory.dmp

    Filesize

    120KB

  • memory/4536-83-0x0000000007D70000-0x0000000007D81000-memory.dmp

    Filesize

    68KB

  • memory/4536-32-0x00000000061F0000-0x0000000006544000-memory.dmp

    Filesize

    3.3MB

  • memory/4536-21-0x0000000006050000-0x00000000060B6000-memory.dmp

    Filesize

    408KB

  • memory/4536-22-0x00000000060C0000-0x0000000006126000-memory.dmp

    Filesize

    408KB

  • memory/4536-87-0x0000000007E90000-0x0000000007E98000-memory.dmp

    Filesize

    32KB

  • memory/4536-20-0x0000000005FB0000-0x0000000005FD2000-memory.dmp

    Filesize

    136KB

  • memory/4536-93-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-18-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-17-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-15-0x0000000074EA0000-0x0000000075650000-memory.dmp

    Filesize

    7.7MB

  • memory/4536-13-0x0000000005260000-0x0000000005296000-memory.dmp

    Filesize

    216KB