Overview

overview

10

Static

static

10

25c305d127...8b.exe

windows7-x64

10

25c305d127...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    24s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    31-07-2024 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    25c305d127aba1ca0802f96df1894c8b.exe

  • Size

    95KB

  • MD5

    25c305d127aba1ca0802f96df1894c8b

  • SHA1

    93f08869422ff5110f363fd62d457fff9a013718

  • SHA256

    eb30714b71fd1cc008d3fcbfee9735807527d6342a14c4898162ed48957d7650

  • SHA512

    72be8d364f22514cdf2d85e0addbd881074b36e4266d376b1485b27d7356a0d6e39af6a290894ea38bd0e079add2fe620d3594f0d71cd4f2a333ba7aaccf471b

  • SSDEEP

    1536:5qs+bqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2Y3tmulgS6p8l:XIwiYj+zi0ZbYe1g0ujyzdC8

Score
10/10
redlinesectopratsvchostcredential_accessdiscoveryinfostealerratspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

svchost

C2

157.66.25.16:47818

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25c305d127aba1ca0802f96df1894c8b.exe
    "C:\Users\Admin\AppData\Local\Temp\25c305d127aba1ca0802f96df1894c8b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:580

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpCCCA.tmp
    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp
    Filesize

    92KB

    MD5

    f2e3c82219257b13b8cd21a887ac0a23

    SHA1

    9fc2d5695d5eddad36899a6a69927ce6b2ef76f2

    SHA256

    bbe72f97a51d05275f862dd16ebdebbf1b5ac34c7085e2dbbf57982ef1a7626b

    SHA512

    f4b63d51ebdf6f10e5ae80414831598206e8b8be7cc6b2dc4c69c8fada1cfb61ee5284c09120cb868ff0e6d6cd84e3f0aa3eef607878b80f924eeb77c418f226

    Download Submit
  • memory/580-0-0x0000000073C0E000-0x0000000073C0F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/580-1-0x0000000000990000-0x00000000009AE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/580-2-0x0000000073C00000-0x00000000742EE000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/580-84-0x0000000073C0E000-0x0000000073C0F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/580-85-0x0000000073C00000-0x00000000742EE000-memory.dmp
    Filesize

    6.9MB

    Download