Analysis
- max time kernel
92s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
07/07/2024, 06:35
General
- Target 557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe
- Size 534KB
- Sample240707-hcftvawcpr
- SHA256 557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5
Malware Config
Extracted
-
redline
-
cheat
-
161.129.65.145:4483
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe"C:\Users\Admin\AppData\Local\Temp\557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QHUdxlYsvof.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QHUdxlYsvof" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7D6.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe"C:\Users\Admin\AppData\Local\Temp\557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
557b3fa206360feb6819be479141409870903732a43861f8e882e3fa5c3f96a5.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_u4gpzozi.ljp.ps1
tmp1042.tmp
tmpB7D6.tmp
tmpEE1.tmp
tmpF15.tmp
tmpF9E.tmp
tmpFB4.tmp
tmpFCA.tmp
memory/1748-86-0x00000000070E0000-0x00000000070E8000-memory.dmp
memory/1748-76-0x0000000006020000-0x000000000603E000-memory.dmp
memory/1748-93-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1748-84-0x0000000007000000-0x0000000007014000-memory.dmp
memory/1748-20-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1748-82-0x0000000006FC0000-0x0000000006FD1000-memory.dmp
memory/1748-81-0x0000000007020000-0x00000000070B6000-memory.dmp
memory/1748-23-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1748-25-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1748-79-0x0000000006DA0000-0x0000000006DBA000-memory.dmp
memory/1748-55-0x0000000006060000-0x0000000006092000-memory.dmp
memory/1748-56-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/1748-28-0x0000000004B50000-0x0000000004BB6000-memory.dmp
memory/1748-29-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/1748-50-0x0000000005550000-0x00000000058A4000-memory.dmp
memory/1752-19-0x0000000005560000-0x0000000005B88000-memory.dmp
memory/1752-80-0x0000000007810000-0x000000000781A000-memory.dmp
memory/1752-17-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1752-92-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1752-85-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/1752-53-0x0000000006470000-0x000000000648E000-memory.dmp
memory/1752-15-0x0000000004EF0000-0x0000000004F26000-memory.dmp
memory/1752-57-0x0000000070CD0000-0x0000000070D1C000-memory.dmp
memory/1752-27-0x00000000054A0000-0x00000000054C2000-memory.dmp
memory/1752-83-0x00000000079F0000-0x00000000079FE000-memory.dmp
memory/1752-16-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/1752-77-0x0000000007660000-0x0000000007703000-memory.dmp
memory/1752-78-0x0000000007DE0000-0x000000000845A000-memory.dmp
memory/1916-94-0x00000000065B0000-0x0000000006772000-memory.dmp
memory/1916-51-0x0000000005020000-0x000000000505C000-memory.dmp
memory/1916-21-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1916-49-0x0000000004FC0000-0x0000000004FD2000-memory.dmp
memory/1916-97-0x0000000006980000-0x000000000699E000-memory.dmp
memory/1916-54-0x00000000052D0000-0x00000000053DA000-memory.dmp
memory/1916-52-0x0000000005080000-0x00000000050CC000-memory.dmp
memory/1916-96-0x0000000006820000-0x0000000006896000-memory.dmp
memory/1916-95-0x0000000006CB0000-0x00000000071DC000-memory.dmp
memory/1916-48-0x00000000056A0000-0x0000000005CB8000-memory.dmp
memory/4880-9-0x0000000006F90000-0x0000000006FF0000-memory.dmp
memory/4880-24-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/4880-7-0x00000000093B0000-0x00000000093B8000-memory.dmp
memory/4880-8-0x0000000005230000-0x000000000523C000-memory.dmp
memory/4880-0-0x00000000743FE000-0x00000000743FF000-memory.dmp
memory/4880-10-0x0000000007090000-0x000000000712C000-memory.dmp
memory/4880-6-0x0000000006E20000-0x0000000006E3A000-memory.dmp
memory/4880-5-0x00000000743F0000-0x0000000074BA0000-memory.dmp
memory/4880-4-0x00000000058A0000-0x00000000058AA000-memory.dmp
memory/4880-3-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/4880-2-0x0000000005E70000-0x0000000006414000-memory.dmp
memory/4880-1-0x0000000000D70000-0x0000000000DFC000-memory.dmp