Analysis
- max time kernel
144s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
28/07/2024, 01:27
General
- Target 91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe
- Size 535KB
- Sample240728-bt9pxstbmg
- SHA256 91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805
Malware Config
Extracted
-
redline
-
cheat
-
185.222.58.236:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe"C:\Users\Admin\AppData\Local\Temp\91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe"C:\Users\Admin\AppData\Local\Temp\91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
91146fa003f23bd4dae8f201f8941d7adc54474bd3215f6b4d3f9a783abc6805.exe.log
tmp1CFA.tmp
tmp1D5E.tmp
tmp1DE7.tmp
tmp1DFC.tmp
tmp1E31.tmp
tmp1EBA.tmp
memory/1188-8-0x0000000005B20000-0x0000000005B2E000-memory.dmp
memory/1188-3-0x00000000058E0000-0x0000000005972000-memory.dmp
memory/1188-9-0x00000000063A0000-0x0000000006400000-memory.dmp
memory/1188-10-0x0000000008920000-0x00000000089BC000-memory.dmp
memory/1188-1-0x0000000000E00000-0x0000000000E8C000-memory.dmp
memory/1188-7-0x0000000005B00000-0x0000000005B0A000-memory.dmp
memory/1188-2-0x0000000005DF0000-0x0000000006394000-memory.dmp
memory/1188-15-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/1188-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp
memory/1188-4-0x0000000005870000-0x000000000587A000-memory.dmp
memory/1188-5-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/1188-6-0x00000000058C0000-0x00000000058D2000-memory.dmp
memory/2912-17-0x0000000004E20000-0x0000000004E32000-memory.dmp
memory/2912-186-0x0000000007270000-0x000000000728E000-memory.dmp
memory/2912-22-0x0000000006400000-0x00000000065C2000-memory.dmp
memory/2912-23-0x0000000006B00000-0x000000000702C000-memory.dmp
memory/2912-19-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/2912-18-0x0000000004E80000-0x0000000004EBC000-memory.dmp
memory/2912-14-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/2912-20-0x0000000004EC0000-0x0000000004F0C000-memory.dmp
memory/2912-21-0x0000000005120000-0x000000000522A000-memory.dmp
memory/2912-11-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2912-178-0x0000000006710000-0x0000000006776000-memory.dmp
memory/2912-185-0x0000000006A00000-0x0000000006A76000-memory.dmp
memory/2912-16-0x00000000053D0000-0x00000000059E8000-memory.dmp
memory/2912-187-0x0000000074E90000-0x0000000075640000-memory.dmp