Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
31-07-2024 01:30
Static task
static1
Behavioral task
behavioral1
Sample
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Resource
win7-20240708-en
General
-
Target
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
-
Size
537KB
-
MD5
9954659fe9b70868e651001b52d17691
-
SHA1
f2035cf1739bd6da81328cdf964f739fa9090110
-
SHA256
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86
-
SHA512
1ac3216f2c3ff24186f565cef6af8816bcba1d96a2ffa9dc242390852db50fdc0411675618ed1d9ef17054fdab122cc6a91e9857805464d540e93ee83d8746ca
-
SSDEEP
12288:HuASY+aZrwrZaOTUTpfS9PyzipZlYsbxI9WZw2i:h/4rEOWulpZlHbcWZG
Malware Config
Extracted
redline
eff123
143.244.169.95:16383
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-28-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2660-31-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2660-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2660-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2660-23-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2808 powershell.exe 2264 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exedescription pid process target process PID 2532 set thread context of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exepid process 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 2808 powershell.exe 2264 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exepowershell.exepowershell.exe788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exedescription pid process Token: SeDebugPrivilege 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 2660 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exedescription pid process target process PID 2532 wrote to memory of 2808 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2808 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2808 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2808 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2264 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2264 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2264 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2264 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe powershell.exe PID 2532 wrote to memory of 2080 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe schtasks.exe PID 2532 wrote to memory of 2080 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe schtasks.exe PID 2532 wrote to memory of 2080 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe schtasks.exe PID 2532 wrote to memory of 2080 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe schtasks.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe PID 2532 wrote to memory of 2660 2532 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe 788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kCpzIBXuOwHQnl.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kCpzIBXuOwHQnl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFA5.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"C:\Users\Admin\AppData\Local\Temp\788006d305b062dfa22b0acf645493fb6ff8c97955d2cd53c89d0df8383dcf86.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a4b338c6648c85dbe54b54c2027d1576
SHA1a132f78620f2d972fc1437c26cacab6ff4bfd2d3
SHA256ebb118d1943ab5841cf6addc55383f9a7d409347fa8f4b00d78551a20f486e9e
SHA5123df3ca531546a6c6291985c1782682d6623923f6b78552ea8fb953ca47f34d935ccd461d2d1306881020efeb8951938f2d5f1ce216ebd7b643b6ee8f7013ba3f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LD4PM1UP74BHNQHBASGG.temp
Filesize7KB
MD5209b009dae3adb6055057c02e5a96ea8
SHA1b301a54a9dc59f2ddafd23c9ab1c396398b2b9d1
SHA2560358820a39aae00ebbaf5c50ef937771cf339abae61275aba09f433b3738ac71
SHA5120a278f5a9c52a4fae847a63bf6206d197359740a8817a898e836d6091381a393e2b3a732211e78d5f3ada5fa894c399d1baf08ac50b8bb2b208dc642e4b236b6