Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 02:25
Static task
static1
Behavioral task
behavioral1
Sample
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
Resource
win7-20240704-en
General
-
Target
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
-
Size
713KB
-
MD5
3599fa63d78413242a88966d3b4b14ef
-
SHA1
44526b00e847d9a16908c79f72dab1af4a2edf29
-
SHA256
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33
-
SHA512
e04604e58c9a0eb4e6bbea99d59295463cb9058f82c2527502acb6fe47989fc4f72b69338bb66ca5c5fc5a62d785fb65fcd4eb272a6136a1c240592076845d73
-
SSDEEP
12288:vV9E8GILjWLWg/yvjaRBv5MIorus1IPI4AMqoYg/6vXdW1JeSel43qiukR:7cam5MI+TIPuM//CXd+JWl46i1
Malware Config
Extracted
redline
cheat
185.222.58.91:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2736-27-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2736-24-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2736-22-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2736-28-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2736-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2736-27-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2736-24-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2736-22-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2736-28-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2736-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2288 powershell.exe 2868 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exedescription pid process target process PID 2408 set thread context of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exepowershell.exepowershell.exepid process 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe 2288 powershell.exe 2868 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exepowershell.exepowershell.exec08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exedescription pid process Token: SeDebugPrivilege 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe Token: SeDebugPrivilege 2868 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeDebugPrivilege 2736 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exedescription pid process target process PID 2408 wrote to memory of 2288 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2288 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2288 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2288 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2868 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2868 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2868 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2868 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe powershell.exe PID 2408 wrote to memory of 2752 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe schtasks.exe PID 2408 wrote to memory of 2752 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe schtasks.exe PID 2408 wrote to memory of 2752 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe schtasks.exe PID 2408 wrote to memory of 2752 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe schtasks.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe PID 2408 wrote to memory of 2736 2408 c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TmfmVKU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TmfmVKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF3B2.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"C:\Users\Admin\AppData\Local\Temp\c08ff513ad0787ed08c72bbdcda0d166e603ea0736f5687b3dddc0f4bb87da33.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF3B2.tmpFilesize
1KB
MD5d7fbe42bd6766fb1af96671938ba2232
SHA1a77caa10488b92e02a56fc0dac42976cf3209f22
SHA256c395331ab7095305c3526b6f7736adc08466b5a0becbf18ac5bbde06f0ebf16f
SHA5123cbedcfe7511312decc9d3cc2285099ad1dd2c3e9a01299ee173f8901d9c009e0de4074e6ea42512336c567076e538c82f801d8302873e873d65d2cbff645c03
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5c8ad1da37b78b4dc105cc480bcc9e751
SHA1d6cd76feb91b491172f1485f4200ba6aaf44ba28
SHA256ebf7696278e38fc4e02e572240418e89d4e5d1efdf58f6e668de03ab44ea62db
SHA512625387eb9f010b69eecc076b014612b854eca11061c1c6a0f8830c0a349c3cb839d24ae5205db905215413134177d191dc63ae85ece8bdfbf1e37c988f7698b9
-
memory/2408-30-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2408-1-0x0000000000BB0000-0x0000000000C64000-memory.dmpFilesize
720KB
-
memory/2408-2-0x00000000004E0000-0x00000000004F0000-memory.dmpFilesize
64KB
-
memory/2408-3-0x0000000074980000-0x000000007506E000-memory.dmpFilesize
6.9MB
-
memory/2408-4-0x0000000000680000-0x000000000068C000-memory.dmpFilesize
48KB
-
memory/2408-5-0x0000000004790000-0x00000000047F0000-memory.dmpFilesize
384KB
-
memory/2408-0-0x000000007498E000-0x000000007498F000-memory.dmpFilesize
4KB
-
memory/2736-27-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-24-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-22-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-20-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-18-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-28-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-29-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2736-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB