Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CATALOGUE.exe
Resource
win7-20240705-en
windows7-x64
10 signatures
150 seconds
General
-
Target
CATALOGUE.exe
-
Size
2.7MB
-
MD5
a3a55457b08e66b8246b3ab4f5afc5f8
-
SHA1
bcfbda193b0091361b4a9ddb06717e219a389351
-
SHA256
2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7
-
SHA512
b61f2d8f84ee90fd08e057cbdb52df0881998b108f1affa156e0250458cef70007a954ae7913129883f46dcb29e5e697e17cbecef835e6c2378cca080a8d7743
-
SSDEEP
12288:mJZ7RmT35hppmYbhFD4IssrqUIb231sarW:mZA5hpZFFDtpIb23CarW
Malware Config
Extracted
Family
redline
Botnet
biss
C2
172.81.131.198:16383
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3176-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3176-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
CATALOGUE.exedescription pid process target process PID 4416 set thread context of 3176 4416 CATALOGUE.exe installutil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
installutil.exepid process 3176 installutil.exe 3176 installutil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CATALOGUE.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 4416 CATALOGUE.exe Token: SeDebugPrivilege 3176 installutil.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
CATALOGUE.exedescription pid process target process PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe PID 4416 wrote to memory of 3176 4416 CATALOGUE.exe installutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CATALOGUE.exe"C:\Users\Admin\AppData\Local\Temp\CATALOGUE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176