Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 01:17
General
- Target 71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe
- Size 460KB
- Sample240729-bnfvnavhpk
- SHA256 71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9
Malware Config
Extracted
-
redline
-
success-logs
-
147.182.130.25:16383
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OvjfYaioz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OvjfYaioz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3033.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"C:\Users\Admin\AppData\Local\Temp\71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
71bfda60ac622c2c4c11a6b317ad9167306770433b33678b4a0a7fcf03a479e9.exe.log
__PSScriptPolicyTest_sor0qvoi.nah.ps1
tmp3033.tmp
tmp5938.tmp
tmp596D.tmp
tmp59B7.tmp
tmp59DC.tmp
tmp5A02.tmp
tmp5A7B.tmp
memory/1028-6-0x0000000005EC0000-0x0000000005ECE000-memory.dmp
memory/1028-48-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1028-14-0x0000000074C7E000-0x0000000074C7F000-memory.dmp
memory/1028-8-0x0000000006500000-0x0000000006560000-memory.dmp
memory/1028-0-0x0000000074C7E000-0x0000000074C7F000-memory.dmp
memory/1028-18-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1028-7-0x00000000064E0000-0x00000000064EE000-memory.dmp
memory/1028-9-0x0000000006770000-0x000000000680C000-memory.dmp
memory/1028-2-0x0000000005760000-0x0000000005D04000-memory.dmp
memory/1028-1-0x0000000000850000-0x00000000008C8000-memory.dmp
memory/1028-4-0x0000000005460000-0x000000000546A000-memory.dmp
memory/1028-5-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1028-3-0x00000000052B0000-0x0000000005342000-memory.dmp
memory/2032-93-0x0000000006D20000-0x0000000006D96000-memory.dmp
memory/2032-24-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2032-91-0x0000000006B50000-0x0000000006D12000-memory.dmp
memory/2032-94-0x0000000006F20000-0x0000000006F3E000-memory.dmp
memory/2032-92-0x0000000007250000-0x000000000777C000-memory.dmp
memory/2032-49-0x0000000005B10000-0x0000000006128000-memory.dmp
memory/2032-50-0x0000000005530000-0x0000000005542000-memory.dmp
memory/2032-51-0x00000000055D0000-0x000000000560C000-memory.dmp
memory/2032-52-0x0000000005610000-0x000000000565C000-memory.dmp
memory/2032-53-0x0000000005870000-0x000000000597A000-memory.dmp
memory/4440-17-0x0000000005AE0000-0x0000000006108000-memory.dmp
memory/4440-85-0x0000000007FB0000-0x0000000007FCA000-memory.dmp
memory/4440-15-0x0000000003020000-0x0000000003056000-memory.dmp
memory/4440-55-0x0000000006EF0000-0x0000000006F22000-memory.dmp
memory/4440-76-0x0000000006F50000-0x0000000006F6E000-memory.dmp
memory/4440-16-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4440-78-0x00000000082C0000-0x000000000893A000-memory.dmp
memory/4440-79-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/4440-80-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/4440-81-0x0000000007EF0000-0x0000000007F86000-memory.dmp
memory/4440-82-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/4440-83-0x0000000007EA0000-0x0000000007EAE000-memory.dmp
memory/4440-19-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4440-57-0x0000000075500000-0x000000007554C000-memory.dmp
memory/4440-25-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/4440-89-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4440-26-0x00000000062D0000-0x0000000006336000-memory.dmp
memory/4440-23-0x00000000061C0000-0x00000000061E2000-memory.dmp
memory/4876-54-0x0000000006430000-0x000000000644E000-memory.dmp
memory/4876-90-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4876-39-0x0000000005EA0000-0x00000000061F4000-memory.dmp
memory/4876-86-0x0000000007A70000-0x0000000007A78000-memory.dmp
memory/4876-22-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4876-21-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/4876-84-0x0000000007990000-0x00000000079A4000-memory.dmp
memory/4876-77-0x0000000007660000-0x0000000007703000-memory.dmp
memory/4876-56-0x0000000075500000-0x000000007554C000-memory.dmp