Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 09:21
Static task
static1
Behavioral task
behavioral1
Sample
124a5529f6b2a63a72ff518b0d13a61d.exe
Resource
win7-20240708-en
General
-
Target
124a5529f6b2a63a72ff518b0d13a61d.exe
-
Size
683KB
-
MD5
124a5529f6b2a63a72ff518b0d13a61d
-
SHA1
767262de49544ec9843c1b7776d28190a28dface
-
SHA256
949fd4ab1f31af8e7ca60994be0e8ab1d96f92ccb339d7aab1b5f969ffc7ba9c
-
SHA512
8a9eec601f2a79fc499c4f90f31e312beb930f54bae1cc931ff08f539aa133cd1f38ec628ae1da6d6e2571b3741fa9a5fd5d8b15c0a340b2e9b8e27734fec3cd
-
SSDEEP
12288:/QoH2aJdblCZIbZPyOs8/xK82AqUL7gVkWck8Gs0lckkR:DHtJZc6TP/J/qUYkWck8Gs0qD
Malware Config
Extracted
redline
cheat
45.137.22.167:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-14-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2264-10-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2264-8-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2264-18-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2264-16-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2264-14-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2264-10-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2264-8-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2264-18-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2264-16-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
124a5529f6b2a63a72ff518b0d13a61d.exedescription pid process target process PID 2308 set thread context of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
124a5529f6b2a63a72ff518b0d13a61d.exe124a5529f6b2a63a72ff518b0d13a61d.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124a5529f6b2a63a72ff518b0d13a61d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 124a5529f6b2a63a72ff518b0d13a61d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
124a5529f6b2a63a72ff518b0d13a61d.exepowershell.exe124a5529f6b2a63a72ff518b0d13a61d.exepid process 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 2564 powershell.exe 2264 124a5529f6b2a63a72ff518b0d13a61d.exe 2264 124a5529f6b2a63a72ff518b0d13a61d.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
124a5529f6b2a63a72ff518b0d13a61d.exe124a5529f6b2a63a72ff518b0d13a61d.exepowershell.exedescription pid process Token: SeDebugPrivilege 2308 124a5529f6b2a63a72ff518b0d13a61d.exe Token: SeDebugPrivilege 2264 124a5529f6b2a63a72ff518b0d13a61d.exe Token: SeDebugPrivilege 2564 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
124a5529f6b2a63a72ff518b0d13a61d.exedescription pid process target process PID 2308 wrote to memory of 2564 2308 124a5529f6b2a63a72ff518b0d13a61d.exe powershell.exe PID 2308 wrote to memory of 2564 2308 124a5529f6b2a63a72ff518b0d13a61d.exe powershell.exe PID 2308 wrote to memory of 2564 2308 124a5529f6b2a63a72ff518b0d13a61d.exe powershell.exe PID 2308 wrote to memory of 2564 2308 124a5529f6b2a63a72ff518b0d13a61d.exe powershell.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe PID 2308 wrote to memory of 2264 2308 124a5529f6b2a63a72ff518b0d13a61d.exe 124a5529f6b2a63a72ff518b0d13a61d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"C:\Users\Admin\AppData\Local\Temp\124a5529f6b2a63a72ff518b0d13a61d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4D67.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp4D7C.tmpFilesize
92KB
MD5a58d87b023e155c10b4e15fdfc6fcb06
SHA10ee449b782aeac54c0406adde543f19ecd9dfd38
SHA256331b040f0bd7731b64e72a837ad86943379ff02e239c305d200108fe7e3c8c61
SHA5121965574101a71a640efb135a49c4a968fd5feb328779c33936047afb2209424b44fba3a1ccdacee959ce5a016f22b49c8b42dc543476b11f83df0feb1b080eae
-
memory/2264-18-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-92-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/2264-20-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/2264-16-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-14-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2264-10-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-8-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-7-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2264-6-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2308-4-0x00000000003C0000-0x00000000003CE000-memory.dmpFilesize
56KB
-
memory/2308-19-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/2308-5-0x0000000004170000-0x00000000041D0000-memory.dmpFilesize
384KB
-
memory/2308-0-0x00000000741EE000-0x00000000741EF000-memory.dmpFilesize
4KB
-
memory/2308-3-0x00000000003B0000-0x00000000003C2000-memory.dmpFilesize
72KB
-
memory/2308-2-0x00000000741E0000-0x00000000748CE000-memory.dmpFilesize
6.9MB
-
memory/2308-1-0x00000000002A0000-0x000000000034E000-memory.dmpFilesize
696KB