Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 08:08
Static task
static1
Behavioral task
behavioral1
Sample
ad86c5cb9f936936ffbae85f43bf2a40N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ad86c5cb9f936936ffbae85f43bf2a40N.exe
Resource
win10v2004-20240709-en
General
-
Target
ad86c5cb9f936936ffbae85f43bf2a40N.exe
-
Size
797KB
-
MD5
ad86c5cb9f936936ffbae85f43bf2a40
-
SHA1
8c3916a0807b528dfbc52f2c7826d7e6cbc2320d
-
SHA256
6e4a44c3de0e80fecece030c2d219e2d20f8bb73366172533f62297d1d5b1d6c
-
SHA512
7ad6645e4c7365ead5ce38853e3002ad184e2f67604439f32be8c13217e5f5e5c9df68f568d2c6bb16ceb947b6ecb949fad95032fc770ef88be8f7e93efe7c93
-
SSDEEP
12288:hVVx0xC0+wZHVUXLCZLiF/d6/7iDlpOWphcotUTEvkR:TVxEC7wZ6cLiFa7YlpOqhcotUEq
Malware Config
Extracted
redline
Commanderking
185.216.70.15:65012
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2584-13-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2584-10-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2584-9-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2584-17-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2584-15-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2584-13-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2584-10-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2584-9-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2584-17-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2584-15-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ad86c5cb9f936936ffbae85f43bf2a40N.exedescription pid process target process PID 2276 set thread context of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ad86c5cb9f936936ffbae85f43bf2a40N.exepowershell.exepid process 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ad86c5cb9f936936ffbae85f43bf2a40N.exead86c5cb9f936936ffbae85f43bf2a40N.exepowershell.exedescription pid process Token: SeDebugPrivilege 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe Token: SeDebugPrivilege 2584 ad86c5cb9f936936ffbae85f43bf2a40N.exe Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
ad86c5cb9f936936ffbae85f43bf2a40N.exedescription pid process target process PID 2276 wrote to memory of 2688 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe powershell.exe PID 2276 wrote to memory of 2688 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe powershell.exe PID 2276 wrote to memory of 2688 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe powershell.exe PID 2276 wrote to memory of 2688 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe powershell.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe PID 2276 wrote to memory of 2584 2276 ad86c5cb9f936936ffbae85f43bf2a40N.exe ad86c5cb9f936936ffbae85f43bf2a40N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad86c5cb9f936936ffbae85f43bf2a40N.exe"C:\Users\Admin\AppData\Local\Temp\ad86c5cb9f936936ffbae85f43bf2a40N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ad86c5cb9f936936ffbae85f43bf2a40N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ad86c5cb9f936936ffbae85f43bf2a40N.exe"C:\Users\Admin\AppData\Local\Temp\ad86c5cb9f936936ffbae85f43bf2a40N.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2276-18-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2276-1-0x0000000000C80000-0x0000000000D44000-memory.dmpFilesize
784KB
-
memory/2276-2-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2276-3-0x0000000000500000-0x0000000000512000-memory.dmpFilesize
72KB
-
memory/2276-4-0x0000000000650000-0x0000000000658000-memory.dmpFilesize
32KB
-
memory/2276-5-0x0000000000660000-0x000000000066E000-memory.dmpFilesize
56KB
-
memory/2276-6-0x0000000002250000-0x00000000022B0000-memory.dmpFilesize
384KB
-
memory/2276-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmpFilesize
4KB
-
memory/2584-20-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2584-24-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2584-7-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-9-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-8-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-17-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-15-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-10-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2584-19-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2584-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2584-23-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2584-13-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB