Analysis
-
max time kernel
26s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
TextUtils.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
TextUtils.exe
Resource
win10v2004-20240802-en
General
-
Target
TextUtils.exe
-
Size
398KB
-
MD5
1c09825dd1fa0637c1d5089a65702ede
-
SHA1
a1da9a5c8d8b79689c9153adf459960fbccde80b
-
SHA256
3eadfa021e89e69ffe4dbf5c3d3eec4843ceb7ad5033498477b914ba6316657b
-
SHA512
948252d25c6a481432c52c762637c66d764f7fd90b0fa65d7c44b21af048b87950f918831b7d716fe65f6d10da42c337cb8b5860f2a223d7dc4c8f9d38d9fc00
-
SSDEEP
12288:kdJoSpPkFtttttttCttttttttttttttpst8ZcxruaZ4A3G31111111111111111/:kdlPgrua13Q11111111111111111D11x
Malware Config
Extracted
redline
UltimateCrackPack
51.83.170.23:16128
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2608-51-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2608-50-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2596-35-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2596-32-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2596-30-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2608-51-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2608-50-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2596-35-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2596-32-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2596-30-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Executes dropped EXE 3 IoCs
pid Process 3048 Ultimate-Crack-Pack.exe 2492 Ultimate-Crack-Pack.exe 2844 Ultimate-Crack-Pack.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\msconfig.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration\\msconfig.exe.exe" powershell.exe -
pid Process 2632 powershell.exe 2576 powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2844 set thread context of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2492 set thread context of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 3048 set thread context of 2588 3048 Ultimate-Crack-Pack.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ultimate-Crack-Pack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ultimate-Crack-Pack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ultimate-Crack-Pack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2576 powershell.exe 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2596 RegAsm.exe Token: SeDebugPrivilege 2608 RegAsm.exe Token: SeDebugPrivilege 2588 RegAsm.exe Token: SeDebugPrivilege 2576 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3048 2488 TextUtils.exe 29 PID 2488 wrote to memory of 3048 2488 TextUtils.exe 29 PID 2488 wrote to memory of 3048 2488 TextUtils.exe 29 PID 2488 wrote to memory of 3048 2488 TextUtils.exe 29 PID 2488 wrote to memory of 1724 2488 TextUtils.exe 30 PID 2488 wrote to memory of 1724 2488 TextUtils.exe 30 PID 2488 wrote to memory of 1724 2488 TextUtils.exe 30 PID 1724 wrote to memory of 2492 1724 TextUtils.exe 31 PID 1724 wrote to memory of 2492 1724 TextUtils.exe 31 PID 1724 wrote to memory of 2492 1724 TextUtils.exe 31 PID 1724 wrote to memory of 2492 1724 TextUtils.exe 31 PID 1724 wrote to memory of 2764 1724 TextUtils.exe 32 PID 1724 wrote to memory of 2764 1724 TextUtils.exe 32 PID 1724 wrote to memory of 2764 1724 TextUtils.exe 32 PID 2764 wrote to memory of 2844 2764 TextUtils.exe 33 PID 2764 wrote to memory of 2844 2764 TextUtils.exe 33 PID 2764 wrote to memory of 2844 2764 TextUtils.exe 33 PID 2764 wrote to memory of 2844 2764 TextUtils.exe 33 PID 2764 wrote to memory of 2848 2764 TextUtils.exe 34 PID 2764 wrote to memory of 2848 2764 TextUtils.exe 34 PID 2764 wrote to memory of 2848 2764 TextUtils.exe 34 PID 3048 wrote to memory of 2632 3048 Ultimate-Crack-Pack.exe 35 PID 3048 wrote to memory of 2632 3048 Ultimate-Crack-Pack.exe 35 PID 3048 wrote to memory of 2632 3048 Ultimate-Crack-Pack.exe 35 PID 3048 wrote to memory of 2632 3048 Ultimate-Crack-Pack.exe 35 PID 2492 wrote to memory of 2576 2492 Ultimate-Crack-Pack.exe 36 PID 2492 wrote to memory of 2576 2492 Ultimate-Crack-Pack.exe 36 PID 2492 wrote to memory of 2576 2492 Ultimate-Crack-Pack.exe 36 PID 2492 wrote to memory of 2576 2492 Ultimate-Crack-Pack.exe 36 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2844 wrote to memory of 2608 2844 Ultimate-Crack-Pack.exe 40 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 2492 wrote to memory of 2596 2492 Ultimate-Crack-Pack.exe 39 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38 PID 3048 wrote to memory of 2588 3048 Ultimate-Crack-Pack.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'msconfig.exe' -Value '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration\msconfig.exe.exe"' -PropertyType 'String'4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate-Crack-Pack.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
-
C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"C:\Users\Admin\AppData\Local\Temp\TextUtils.exe"4⤵PID:2848
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5dc6f230a993249cbe632aea3edbbd63e
SHA1ee67ed14eb647918d0d7ffd11ba7b665eeb19c27
SHA256a6c001e47fd68b6c97fa484c5c98f918eed5d231bd8f1a4e4ad65af20788118b
SHA5127e9b46e5d8e8fa609c839d570cf6cf80c7464de553f094e02b6f86e96dc81ce65a1f5f071acd6fadec9d1f4690f48972d4425a7dc2bb0bab7d0588eae81fa5e2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e5fc9cdb034e4d751d41f392bc99603f
SHA176660fd731dbad575ae3bed8ab8f5042c2048050
SHA2566c3b52047758b3b401f47fa854f0b967db2ea81acbf6100b4dd417e9b048db55
SHA512b1ffea42e31dca781afe849051aacd2a0d1901ccac73e12472d855a366724bf87b388b6fb8af29175dbd70416a133909672214a5b42aaabd9d7eca4618a85fdf