Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 13:31
Static task
static1
Behavioral task
behavioral1
Sample
18da95aef5e992aacfe205534cb0b73c.exe
Resource
win7-20240704-en
General
-
Target
18da95aef5e992aacfe205534cb0b73c.exe
-
Size
713KB
-
MD5
18da95aef5e992aacfe205534cb0b73c
-
SHA1
9ed5b6c676ffbde8b15779078e5d23e0bbebfed5
-
SHA256
26c199fee4db63767ab6a7ca3b251ebaa3d8d08150d1aebef56546bdb5ea395a
-
SHA512
4a0ab26d6f4f98550bc8b8ada81a5c0e4acf83b5603d23322126fc1bf1200913467460c411f0bc18d5bc45266b03e6033d75ae999c4ac32119d03128d7a4cf3e
-
SSDEEP
12288:8xaE8GILjWLWgumApXye0917WKVpkQRPArxQbXStkR:dcuzTw17WKVpkQRPaxJw
Malware Config
Extracted
redline
cheat
45.137.22.124:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2764-22-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-27-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-24-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2764-31-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2764-22-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-27-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-24-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2764-31-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2836 powershell.exe 2328 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
18da95aef5e992aacfe205534cb0b73c.exedescription pid process target process PID 2116 set thread context of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
18da95aef5e992aacfe205534cb0b73c.exepowershell.exepowershell.exe18da95aef5e992aacfe205534cb0b73c.exepid process 2116 18da95aef5e992aacfe205534cb0b73c.exe 2116 18da95aef5e992aacfe205534cb0b73c.exe 2116 18da95aef5e992aacfe205534cb0b73c.exe 2116 18da95aef5e992aacfe205534cb0b73c.exe 2328 powershell.exe 2836 powershell.exe 2764 18da95aef5e992aacfe205534cb0b73c.exe 2764 18da95aef5e992aacfe205534cb0b73c.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
18da95aef5e992aacfe205534cb0b73c.exepowershell.exepowershell.exe18da95aef5e992aacfe205534cb0b73c.exedescription pid process Token: SeDebugPrivilege 2116 18da95aef5e992aacfe205534cb0b73c.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2764 18da95aef5e992aacfe205534cb0b73c.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
18da95aef5e992aacfe205534cb0b73c.exedescription pid process target process PID 2116 wrote to memory of 2328 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2328 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2328 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2328 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2836 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2836 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2836 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2836 2116 18da95aef5e992aacfe205534cb0b73c.exe powershell.exe PID 2116 wrote to memory of 2868 2116 18da95aef5e992aacfe205534cb0b73c.exe schtasks.exe PID 2116 wrote to memory of 2868 2116 18da95aef5e992aacfe205534cb0b73c.exe schtasks.exe PID 2116 wrote to memory of 2868 2116 18da95aef5e992aacfe205534cb0b73c.exe schtasks.exe PID 2116 wrote to memory of 2868 2116 18da95aef5e992aacfe205534cb0b73c.exe schtasks.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe PID 2116 wrote to memory of 2764 2116 18da95aef5e992aacfe205534cb0b73c.exe 18da95aef5e992aacfe205534cb0b73c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18da95aef5e992aacfe205534cb0b73c.exe"C:\Users\Admin\AppData\Local\Temp\18da95aef5e992aacfe205534cb0b73c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\18da95aef5e992aacfe205534cb0b73c.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NaVTctkOT.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NaVTctkOT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDE9C.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\18da95aef5e992aacfe205534cb0b73c.exe"C:\Users\Admin\AppData\Local\Temp\18da95aef5e992aacfe205534cb0b73c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9B3.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp9C9.tmpFilesize
92KB
MD5cf00cf5b059b43e29cbde1a36c6209f3
SHA19df2f8ef60997e3934fef0d88f9770fb9d19769f
SHA2569f861e6046979ac19a569747cd17b7e77a8e1301c870691595a68d9a8244a30a
SHA51216e433a67de26cbf052f2639df05c5d3d2c5ef5d4ef065b45af913174e08415bd6672f6637e8727e88b2e68c74c2ffeabc6673e1506e8ad397edb198e0276399
-
C:\Users\Admin\AppData\Local\Temp\tmpDE9C.tmpFilesize
1KB
MD532b5ce2c146891131abce7a72e6c9815
SHA1d94f9ec387f6effa5736c63e6581a110f3df867a
SHA256ebab1a4a58d97ac8aa217bf0512fb13b53019e9eb428806818385e755f5822d2
SHA5125a588fdbaef56e8cc3b9588b77610cf561a0eddda4a2fed2a1bbbf097aca7bc9767f1f376aa44a884607603393c3dbef0d5d47b175ccc1697f8b91fbe856e5a3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IR8UNFJ3YQF9XW62F2R2.tempFilesize
7KB
MD580d2e4e68b95818f80134141fbf224c8
SHA1ed68191c70a8365d0d03ad3ad7a96043db5a1f08
SHA256cc7307587c653f918309bd2eb04e6ecceb5c59ed7c8c6ee45734f24ca5401a81
SHA51291eba9d1b922311f6032bcd1383f359bcfb303f3865e281b540cea0272186a5b7429fe5c24bed947d12d390627519659f5224b67671c53a508effeb38933873f
-
memory/2116-28-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/2116-1-0x0000000000980000-0x0000000000A34000-memory.dmpFilesize
720KB
-
memory/2116-2-0x00000000003B0000-0x00000000003C0000-memory.dmpFilesize
64KB
-
memory/2116-3-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/2116-4-0x0000000001FD0000-0x0000000001FDC000-memory.dmpFilesize
48KB
-
memory/2116-5-0x0000000004750000-0x00000000047B0000-memory.dmpFilesize
384KB
-
memory/2116-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmpFilesize
4KB
-
memory/2764-22-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-20-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-18-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-24-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-29-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-31-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2764-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2764-27-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB