Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/08/2024, 01:28
General
- Target bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe
- Size 2.2MB
- Sample240818-bvtp4axgmc
- SHA256 bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f
Malware Config
Extracted
-
redline
-
Newest
-
77.90.44.31:65012
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe"C:\Users\Admin\AppData\Local\Temp\bd9c7fc40fa376b53d23750021bc645ade1e4215a1265b1fc50665b01562b12f.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
tmpAEF4.tmp
tmpAF0A.tmp
tmpAF25.tmp
tmpAF3B.tmp
tmpAF51.tmp
tmpAF6C.tmp
memory/2928-6-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2928-0-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2928-8-0x00000000063E0000-0x00000000065A2000-memory.dmp
memory/2928-9-0x0000000006AE0000-0x000000000700C000-memory.dmp
memory/2928-10-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/2928-29-0x0000000006860000-0x00000000068D6000-memory.dmp
memory/2928-30-0x0000000007010000-0x00000000070A2000-memory.dmp
memory/2928-31-0x0000000007660000-0x0000000007C04000-memory.dmp
memory/2928-32-0x0000000007310000-0x000000000732E000-memory.dmp
memory/2928-7-0x00000000052A0000-0x00000000053AA000-memory.dmp
memory/2928-5-0x0000000005110000-0x000000000515C000-memory.dmp
memory/2928-4-0x00000000050D0000-0x000000000510C000-memory.dmp
memory/2928-3-0x0000000005070000-0x0000000005082000-memory.dmp
memory/2928-2-0x00000000057B0000-0x0000000005DC8000-memory.dmp
memory/2928-1-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/2928-187-0x00000000744EE000-0x00000000744EF000-memory.dmp
memory/2928-188-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2928-190-0x00000000744E0000-0x0000000074C90000-memory.dmp