Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2024 09:21

General

  • Target

    124a5529f6b2a63a72ff518b0d13a61d.exe

  • Size

    683KB

  • MD5

    124a5529f6b2a63a72ff518b0d13a61d

  • SHA1

    767262de49544ec9843c1b7776d28190a28dface

  • SHA256

    949fd4ab1f31af8e7ca60994be0e8ab1d96f92ccb339d7aab1b5f969ffc7ba9c

  • SHA512

    8a9eec601f2a79fc499c4f90f31e312beb930f54bae1cc931ff08f539aa133cd1f38ec628ae1da6d6e2571b3741fa9a5fd5d8b15c0a340b2e9b8e27734fec3cd

  • SSDEEP

    12288:/QoH2aJdblCZIbZPyOs8/xK82AqUL7gVkWck8Gs0lckkR:DHtJZc6TP/J/qUYkWck8Gs0qD

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.167:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe
    "C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3388
    • C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe
      "C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"
      2⤵
        PID:2616
      • C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe
        "C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2516

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\124a5529f6b2a63a72ff518b0d13a61d.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ngar3obi.fwt.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp3270.tmp

      Filesize

      40KB

      MD5

      a182561a527f929489bf4b8f74f65cd7

      SHA1

      8cd6866594759711ea1836e86a5b7ca64ee8911f

      SHA256

      42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

      SHA512

      9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

    • C:\Users\Admin\AppData\Local\Temp\tmp3286.tmp

      Filesize

      114KB

      MD5

      e228c51c082ab10d054c3ddc12f0d34c

      SHA1

      79b5574c9ce43d2195dcbfaf32015f473dfa4d2e

      SHA256

      02f65483e90802c728726ce1d16f2b405158f666c36e2c63090e27877ae4e309

      SHA512

      233ca5e06591e1646edfadb84a31bdfc12632fb73c47240a2109020accfbd1e337371bcc3340eae7a1f04140bbdeb0b416ce2de00fa85671671bb5f6c04aa822

    • C:\Users\Admin\AppData\Local\Temp\tmp32C1.tmp

      Filesize

      48KB

      MD5

      349e6eb110e34a08924d92f6b334801d

      SHA1

      bdfb289daff51890cc71697b6322aa4b35ec9169

      SHA256

      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

      SHA512

      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

    • C:\Users\Admin\AppData\Local\Temp\tmp32C7.tmp

      Filesize

      20KB

      MD5

      49693267e0adbcd119f9f5e02adf3a80

      SHA1

      3ba3d7f89b8ad195ca82c92737e960e1f2b349df

      SHA256

      d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

      SHA512

      b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

    • C:\Users\Admin\AppData\Local\Temp\tmp32DC.tmp

      Filesize

      116KB

      MD5

      f70aa3fa04f0536280f872ad17973c3d

      SHA1

      50a7b889329a92de1b272d0ecf5fce87395d3123

      SHA256

      8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

      SHA512

      30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

    • C:\Users\Admin\AppData\Local\Temp\tmp3308.tmp

      Filesize

      96KB

      MD5

      40f3eb83cc9d4cdb0ad82bd5ff2fb824

      SHA1

      d6582ba879235049134fa9a351ca8f0f785d8835

      SHA256

      cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

      SHA512

      cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

    • memory/2516-10-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/2516-249-0x0000000006B00000-0x0000000006B76000-memory.dmp

      Filesize

      472KB

    • memory/2516-250-0x0000000007290000-0x00000000072AE000-memory.dmp

      Filesize

      120KB

    • memory/2516-251-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2516-64-0x0000000006D00000-0x000000000722C000-memory.dmp

      Filesize

      5.2MB

    • memory/2516-63-0x0000000006600000-0x00000000067C2000-memory.dmp

      Filesize

      1.8MB

    • memory/2516-18-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

      Filesize

      72KB

    • memory/2516-20-0x0000000005040000-0x000000000507C000-memory.dmp

      Filesize

      240KB

    • memory/2516-37-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2516-36-0x00000000052E0000-0x00000000053EA000-memory.dmp

      Filesize

      1.0MB

    • memory/2516-15-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/2516-16-0x00000000055E0000-0x0000000005BF8000-memory.dmp

      Filesize

      6.1MB

    • memory/2516-21-0x0000000005080000-0x00000000050CC000-memory.dmp

      Filesize

      304KB

    • memory/3388-24-0x0000000005F00000-0x0000000005F66000-memory.dmp

      Filesize

      408KB

    • memory/3388-56-0x0000000007A70000-0x0000000007A81000-memory.dmp

      Filesize

      68KB

    • memory/3388-34-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-23-0x0000000005E60000-0x0000000005EC6000-memory.dmp

      Filesize

      408KB

    • memory/3388-13-0x0000000004F70000-0x0000000004FA6000-memory.dmp

      Filesize

      216KB

    • memory/3388-35-0x0000000005F70000-0x00000000062C4000-memory.dmp

      Filesize

      3.3MB

    • memory/3388-17-0x0000000005680000-0x0000000005CA8000-memory.dmp

      Filesize

      6.2MB

    • memory/3388-19-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/3388-38-0x0000000006540000-0x000000000655E000-memory.dmp

      Filesize

      120KB

    • memory/3388-39-0x0000000006B10000-0x0000000006B42000-memory.dmp

      Filesize

      200KB

    • memory/3388-40-0x00000000735E0000-0x000000007362C000-memory.dmp

      Filesize

      304KB

    • memory/3388-50-0x0000000007510000-0x000000000752E000-memory.dmp

      Filesize

      120KB

    • memory/3388-51-0x0000000007560000-0x0000000007603000-memory.dmp

      Filesize

      652KB

    • memory/3388-53-0x0000000007870000-0x000000000788A000-memory.dmp

      Filesize

      104KB

    • memory/3388-52-0x0000000007EB0000-0x000000000852A000-memory.dmp

      Filesize

      6.5MB

    • memory/3388-54-0x00000000078E0000-0x00000000078EA000-memory.dmp

      Filesize

      40KB

    • memory/3388-55-0x0000000007AF0000-0x0000000007B86000-memory.dmp

      Filesize

      600KB

    • memory/3388-22-0x0000000005DC0000-0x0000000005DE2000-memory.dmp

      Filesize

      136KB

    • memory/3388-57-0x0000000007AA0000-0x0000000007AAE000-memory.dmp

      Filesize

      56KB

    • memory/3388-58-0x0000000007AB0000-0x0000000007AC4000-memory.dmp

      Filesize

      80KB

    • memory/3388-59-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

      Filesize

      104KB

    • memory/3388-60-0x0000000007B90000-0x0000000007B98000-memory.dmp

      Filesize

      32KB

    • memory/3388-62-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4080-14-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4080-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

      Filesize

      4KB

    • memory/4080-9-0x0000000006910000-0x0000000006970000-memory.dmp

      Filesize

      384KB

    • memory/4080-8-0x00000000068F0000-0x00000000068FE000-memory.dmp

      Filesize

      56KB

    • memory/4080-7-0x0000000005B30000-0x0000000005B42000-memory.dmp

      Filesize

      72KB

    • memory/4080-6-0x0000000005880000-0x000000000591C000-memory.dmp

      Filesize

      624KB

    • memory/4080-5-0x0000000074B10000-0x00000000752C0000-memory.dmp

      Filesize

      7.7MB

    • memory/4080-4-0x00000000057D0000-0x00000000057DA000-memory.dmp

      Filesize

      40KB

    • memory/4080-3-0x0000000005630000-0x00000000056C2000-memory.dmp

      Filesize

      584KB

    • memory/4080-2-0x0000000005B40000-0x00000000060E4000-memory.dmp

      Filesize

      5.6MB

    • memory/4080-1-0x0000000000B80000-0x0000000000C2E000-memory.dmp

      Filesize

      696KB