Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2024 01:30

General

  • Target

    788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe

  • Size

    537KB

  • MD5

    9954659fe9b70868e651001b52d17691

  • SHA1

    f2035cf1739bd6da81328cdf964f739fa9090110

  • SHA256

    788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86

  • SHA512

    1ac3216f2c3ff24186f565cef6af8816bcba1d96a2ffa9dc242390852db50fdc0411675618ed1d9ef17054fdab122cc6a91e9857805464d540e93ee83d8746ca

  • SSDEEP

    12288:HuASY+aZrwrZaOTUTpfS9PyzipZlYsbxI9WZw2i:h/4rEOWulpZlHbcWZG

Malware Config

Extracted

Family

redline

Botnet

eff123

C2

143.244.169.95:16383

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
    "C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kCpzIBXuOwHQnl.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2264
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kCpzIBXuOwHQnl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFA5.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2080
    • C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
      "C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpDFA5.tmp

    Filesize

    1KB

    MD5

    a4b338c6648c85dbe54b54c2027d1576

    SHA1

    a132f78620f2d972fc1437c26cacab6ff4bfd2d3

    SHA256

    ebb118d1943ab5841cf6addc55383f9a7d409347fa8f4b00d78551a20f486e9e

    SHA512

    3df3ca531546a6c6291985c1782682d6623923f6b78552ea8fb953ca47f34d935ccd461d2d1306881020efeb8951938f2d5f1ce216ebd7b643b6ee8f7013ba3f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LD4PM1UP74BHNQHBASGG.temp

    Filesize

    7KB

    MD5

    209b009dae3adb6055057c02e5a96ea8

    SHA1

    b301a54a9dc59f2ddafd23c9ab1c396398b2b9d1

    SHA256

    0358820a39aae00ebbaf5c50ef937771cf339abae61275aba09f433b3738ac71

    SHA512

    0a278f5a9c52a4fae847a63bf6206d197359740a8817a898e836d6091381a393e2b3a732211e78d5f3ada5fa894c399d1baf08ac50b8bb2b208dc642e4b236b6

  • memory/2532-5-0x0000000001FC0000-0x0000000001FCE000-memory.dmp

    Filesize

    56KB

  • memory/2532-32-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

  • memory/2532-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

    Filesize

    4KB

  • memory/2532-4-0x0000000001F60000-0x0000000001F6A000-memory.dmp

    Filesize

    40KB

  • memory/2532-6-0x0000000004750000-0x00000000047B0000-memory.dmp

    Filesize

    384KB

  • memory/2532-2-0x0000000000510000-0x0000000000522000-memory.dmp

    Filesize

    72KB

  • memory/2532-1-0x0000000000280000-0x000000000030C000-memory.dmp

    Filesize

    560KB

  • memory/2532-3-0x0000000073F80000-0x000000007466E000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-19-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2660-22-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB