Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
16/07/2024, 09:41
General
- Target 24a0fca0ed4e41562a676366af495f6a.exe
- Size 641KB
- Sample240716-lnrl9syfmd
- SHA256 9ad8a7c40f6360a17fa6a3d50bb25e97e87b042a6ae1555d089e32f0ab6d08a8
Malware Config
Extracted
-
redline
-
cheat
-
185.222.57.74:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pCchvpbATSqSt.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pCchvpbATSqSt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC3EC.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"C:\Users\Admin\AppData\Local\Temp\24a0fca0ed4e41562a676366af495f6a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
24a0fca0ed4e41562a676366af495f6a.exe.log
__PSScriptPolicyTest_quwnkvch.cvn.ps1
tmpC3EC.tmp
memory/976-8-0x0000000005AE0000-0x0000000005AEE000-memory.dmp
memory/976-4-0x00000000056F0000-0x00000000056FA000-memory.dmp
memory/976-5-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/976-6-0x00000000057E0000-0x00000000057F2000-memory.dmp
memory/976-7-0x0000000005AD0000-0x0000000005AD8000-memory.dmp
memory/976-3-0x0000000005540000-0x00000000055D2000-memory.dmp
memory/976-9-0x0000000006990000-0x00000000069F0000-memory.dmp
memory/976-10-0x0000000009020000-0x00000000090BC000-memory.dmp
memory/976-2-0x0000000005AF0000-0x0000000006094000-memory.dmp
memory/976-48-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/976-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp
memory/976-1-0x0000000000BF0000-0x0000000000C90000-memory.dmp
memory/976-25-0x0000000074F8E000-0x0000000074F8F000-memory.dmp
memory/1664-17-0x0000000004FF0000-0x0000000005618000-memory.dmp
memory/1664-53-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/1664-90-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/1664-19-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/1664-84-0x0000000007340000-0x000000000734E000-memory.dmp
memory/1664-82-0x0000000007390000-0x0000000007426000-memory.dmp
memory/1664-18-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/1664-81-0x0000000007180000-0x000000000718A000-memory.dmp
memory/1664-27-0x00000000057B0000-0x0000000005B04000-memory.dmp
memory/1664-79-0x0000000007110000-0x000000000712A000-memory.dmp
memory/1664-16-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/1664-15-0x00000000024D0000-0x0000000002506000-memory.dmp
memory/1664-73-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/1664-56-0x0000000006DC0000-0x0000000006DF2000-memory.dmp
memory/1664-57-0x0000000075810000-0x000000007585C000-memory.dmp
memory/3276-55-0x0000000005700000-0x000000000580A000-memory.dmp
memory/3276-46-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3276-93-0x00000000070E0000-0x000000000760C000-memory.dmp
memory/3276-52-0x0000000005470000-0x00000000054AC000-memory.dmp
memory/3276-51-0x00000000053B0000-0x00000000053C2000-memory.dmp
memory/3276-50-0x0000000005A90000-0x00000000060A8000-memory.dmp
memory/3276-92-0x00000000069E0000-0x0000000006BA2000-memory.dmp
memory/3276-54-0x0000000005410000-0x000000000545C000-memory.dmp
memory/4136-22-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/4136-21-0x0000000005370000-0x0000000005392000-memory.dmp
memory/4136-80-0x0000000007C90000-0x000000000830A000-memory.dmp
memory/4136-78-0x00000000072F0000-0x0000000007393000-memory.dmp
memory/4136-83-0x0000000007840000-0x0000000007851000-memory.dmp
memory/4136-23-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/4136-85-0x0000000007880000-0x0000000007894000-memory.dmp
memory/4136-86-0x0000000007980000-0x000000000799A000-memory.dmp
memory/4136-87-0x0000000007960000-0x0000000007968000-memory.dmp
memory/4136-26-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/4136-91-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/4136-67-0x0000000075810000-0x000000007585C000-memory.dmp
memory/4136-20-0x0000000074F80000-0x0000000075730000-memory.dmp