Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe
Resource
win7-20240704-en
General
-
Target
9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe
-
Size
734KB
-
MD5
5404b47556a2e1e9eb2f5da481002616
-
SHA1
e3a45833fecb92ff8998fc6d4a13c9b80afe87db
-
SHA256
9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f
-
SHA512
f3ff71f4a5637845e482e5d28656b2c7a502922ffdd599def1f243774820adc16c7de5a6804f2acff497568c93cdf180259628f2784da9dd16b9cc993e41edaf
-
SSDEEP
12288:eYQyrJBxjjmHI8/fRRCtRazozhlzs+WxuEvhxYInrLQ3MqzNF7+wdIH8dZs3:eYlJBxjCHdRRSRNzfzs+0uE5xYwrLQ8b
Malware Config
Extracted
redline
cheat
185.222.57.67:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-51-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1544-48-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1544-46-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1544-54-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1544-53-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-51-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1544-48-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1544-46-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1544-54-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1544-53-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2152 powershell.exe 2628 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
PO.exePO.exepid process 2356 PO.exe 1544 PO.exe -
Loads dropped DLL 6 IoCs
Processes:
9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exePO.exepid process 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe 2356 PO.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 2356 set thread context of 1544 2356 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exepid process 2356 PO.exe 2356 PO.exe 2356 PO.exe 2356 PO.exe 2628 powershell.exe 2152 powershell.exe 1544 PO.exe 1544 PO.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 2356 PO.exe Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 1544 PO.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2400 DllHost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exePO.exedescription pid process target process PID 2208 wrote to memory of 2356 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe PO.exe PID 2208 wrote to memory of 2356 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe PO.exe PID 2208 wrote to memory of 2356 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe PO.exe PID 2208 wrote to memory of 2356 2208 9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe PO.exe PID 2356 wrote to memory of 2152 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2152 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2152 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2152 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2628 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2628 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2628 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2628 2356 PO.exe powershell.exe PID 2356 wrote to memory of 2680 2356 PO.exe schtasks.exe PID 2356 wrote to memory of 2680 2356 PO.exe schtasks.exe PID 2356 wrote to memory of 2680 2356 PO.exe schtasks.exe PID 2356 wrote to memory of 2680 2356 PO.exe schtasks.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe PID 2356 wrote to memory of 1544 2356 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe"C:\Users\Admin\AppData\Local\Temp\9c6f132ef4142409bd7a1448d3dc52f774e9e33919031dac82f2afb27083945f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QntRsaVyLKlY.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QntRsaVyLKlY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1239.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\tmp1239.tmpFilesize
1KB
MD52cf3b508e52d3d31807e75c7644bb626
SHA1746e43f9e547e99dfd3a2d5e068eaa6797ad6c0a
SHA256ce25be226e5476370ffeea5b4ce15b3a6233405a1a8d99484e67849d45d82e0f
SHA512d27ab0ca6868d02375660c4a93f885ecda5eece2ded339d05b2a8dcddfcde5efbdb0ba86a66b6a3d5847aa0aa574d3e1fb1bcc95421b0fa05b12c0225b44e845
-
C:\Users\Admin\AppData\Local\Temp\tmp3584.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp3599.tmpFilesize
92KB
MD5cf00cf5b059b43e29cbde1a36c6209f3
SHA19df2f8ef60997e3934fef0d88f9770fb9d19769f
SHA2569f861e6046979ac19a569747cd17b7e77a8e1301c870691595a68d9a8244a30a
SHA51216e433a67de26cbf052f2639df05c5d3d2c5ef5d4ef065b45af913174e08415bd6672f6637e8727e88b2e68c74c2ffeabc6673e1506e8ad397edb198e0276399
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6W58K8X6NXQJ7EXNWO9V.tempFilesize
7KB
MD51efa27d42eaf1365af959737cc2fa840
SHA197291f1b94dd4e7fd48f828e32a5616b56528942
SHA2566ef235794ca2a71ac0e11765915cf5415810f35b69da3dbca0559bef857d487e
SHA512a5e33bf512a35f56800a6d5f676f37b7b5ab0460e269f988f74bfed31709050390e37cde9c7d7b7aecada4f12a23474f194c0534f87da12cb542c2b510de3f78
-
\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
538KB
MD58a9837f38bd2c2adda21106e3b75ffa8
SHA1d03bc9129aeb9af731afd9fd676487592c48fc5b
SHA256fdb3927ebecb2d7611d047be77c913e6848d24d87ec24d84d76e851839d2fadb
SHA512ac938fff9572a37a2fb801999fe7a2ee9dc72ce0fb4a4878aa2ef2676e76477aaeb9f6a248b92682425f3dfc911835b757c688ff8deb5a48aa92cfdbb03161cd
-
memory/1544-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1544-44-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-53-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-48-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-51-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-54-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-42-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1544-46-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2208-4-0x0000000000DF0000-0x0000000000DF2000-memory.dmpFilesize
8KB
-
memory/2356-27-0x0000000000350000-0x000000000035E000-memory.dmpFilesize
56KB
-
memory/2356-24-0x0000000000E70000-0x0000000000EF8000-memory.dmpFilesize
544KB
-
memory/2356-28-0x0000000000C40000-0x0000000000CA0000-memory.dmpFilesize
384KB
-
memory/2356-26-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/2400-5-0x0000000000090000-0x0000000000092000-memory.dmpFilesize
8KB
-
memory/2400-55-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/2400-7-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB