Analysis
- max time kernel
146s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
27/07/2024, 02:11
General
- Target 304ea6d5cf3786d19de14f004d7d057a.exe
- Size 550KB
- Sample240727-cl9wdstcle
- SHA256 89dd158d0ffdb6d661672343d36f5a87907e1cc60a0e9e85c892f75228eb399b
Malware Config
Extracted
-
redline
-
cheat
-
185.222.57.151:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LjGABleGAy.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LjGABleGAy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E7.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"C:\Users\Admin\AppData\Local\Temp\304ea6d5cf3786d19de14f004d7d057a.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
304ea6d5cf3786d19de14f004d7d057a.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rida2vee.qoi.ps1
tmp5E7.tmp
memory/1220-81-0x0000000006F80000-0x0000000006F8A000-memory.dmp
memory/1220-82-0x0000000007190000-0x0000000007226000-memory.dmp
memory/1220-80-0x0000000006F10000-0x0000000006F2A000-memory.dmp
memory/1220-26-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1220-63-0x0000000073DE0000-0x0000000073E2C000-memory.dmp
memory/1220-79-0x0000000007560000-0x0000000007BDA000-memory.dmp
memory/1220-78-0x0000000006DF0000-0x0000000006E93000-memory.dmp
memory/1220-96-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1220-19-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/2316-8-0x0000000004DB0000-0x0000000004DBE000-memory.dmp
memory/2316-3-0x0000000004AF0000-0x0000000004B82000-memory.dmp
memory/2316-11-0x000000007531E000-0x000000007531F000-memory.dmp
memory/2316-10-0x0000000007CE0000-0x0000000007D7C000-memory.dmp
memory/2316-1-0x00000000000A0000-0x000000000012C000-memory.dmp
memory/2316-2-0x0000000005180000-0x0000000005724000-memory.dmp
memory/2316-0-0x000000007531E000-0x000000007531F000-memory.dmp
memory/2316-9-0x0000000004E50000-0x0000000004EB0000-memory.dmp
memory/2316-7-0x0000000004D90000-0x0000000004D9A000-memory.dmp
memory/2316-6-0x0000000004BB0000-0x0000000004BC2000-memory.dmp
memory/2316-39-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/2316-5-0x0000000004BA0000-0x0000000004BAA000-memory.dmp
memory/2316-4-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/2860-84-0x00000000065E0000-0x00000000067A2000-memory.dmp
memory/2860-51-0x0000000004FE0000-0x0000000004FF2000-memory.dmp
memory/2860-50-0x0000000005730000-0x0000000005D48000-memory.dmp
memory/2860-24-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2860-53-0x0000000005040000-0x000000000507C000-memory.dmp
memory/2860-85-0x0000000006CE0000-0x000000000720C000-memory.dmp
memory/2860-55-0x00000000052F0000-0x00000000053FA000-memory.dmp
memory/4720-17-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4720-57-0x0000000073DE0000-0x0000000073E2C000-memory.dmp
memory/4720-77-0x00000000068E0000-0x00000000068FE000-memory.dmp
memory/4720-56-0x00000000068A0000-0x00000000068D2000-memory.dmp
memory/4720-54-0x0000000006380000-0x00000000063CC000-memory.dmp
memory/4720-52-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/4720-23-0x0000000005410000-0x0000000005432000-memory.dmp
memory/4720-25-0x0000000005B00000-0x0000000005B66000-memory.dmp
memory/4720-49-0x0000000005CA0000-0x0000000005FF4000-memory.dmp
memory/4720-83-0x0000000007820000-0x0000000007831000-memory.dmp
memory/4720-27-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4720-22-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4720-86-0x0000000007850000-0x000000000785E000-memory.dmp
memory/4720-87-0x0000000007860000-0x0000000007874000-memory.dmp
memory/4720-88-0x0000000007960000-0x000000000797A000-memory.dmp
memory/4720-89-0x0000000007940000-0x0000000007948000-memory.dmp
memory/4720-20-0x0000000005460000-0x0000000005A88000-memory.dmp
memory/4720-18-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4720-95-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4720-15-0x00000000029F0000-0x0000000002A26000-memory.dmp