Analysis
- max time kernel
133s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/08/2024, 01:16
General
- Target 743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe
- Size 559KB
- Sample240825-bmvmessaln
- SHA256 743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa
Malware Config
Extracted
-
redline
-
cheat
-
45.137.22.179:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe"C:\Users\Admin\AppData\Local\Temp\743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dbvHXhxkUsvqID.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dbvHXhxkUsvqID" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE73.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe"C:\Users\Admin\AppData\Local\Temp\743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
743c48a643d48ec97873c45298b5e1a7133fe8471d73d367f10c68f362cc3afa.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_pcn0nbsh.1al.ps1
tmp517E.tmp
tmp5193.tmp
tmp51AF.tmp
tmp51D4.tmp
tmp51EA.tmp
tmp5215.tmp
tmpE73.tmp
memory/464-86-0x0000000007320000-0x000000000732E000-memory.dmp
memory/464-50-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/464-84-0x0000000007370000-0x0000000007406000-memory.dmp
memory/464-83-0x0000000007160000-0x000000000716A000-memory.dmp
memory/464-58-0x0000000006D50000-0x0000000006D82000-memory.dmp
memory/464-59-0x0000000074F60000-0x0000000074FAC000-memory.dmp
memory/464-21-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/464-69-0x0000000006380000-0x000000000639E000-memory.dmp
memory/464-80-0x0000000006DA0000-0x0000000006E43000-memory.dmp
memory/464-25-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/464-87-0x0000000007330000-0x0000000007344000-memory.dmp
memory/464-89-0x0000000007410000-0x0000000007418000-memory.dmp
memory/464-96-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4560-19-0x0000000004D00000-0x0000000005328000-memory.dmp
memory/4560-95-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4560-27-0x0000000005580000-0x00000000058D4000-memory.dmp
memory/4560-47-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4560-22-0x0000000004CD0000-0x0000000004CF2000-memory.dmp
memory/4560-88-0x0000000007200000-0x000000000721A000-memory.dmp
memory/4560-85-0x00000000070C0000-0x00000000070D1000-memory.dmp
memory/4560-17-0x0000000004620000-0x0000000004656000-memory.dmp
memory/4560-18-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/4560-55-0x0000000005B90000-0x0000000005BAE000-memory.dmp
memory/4560-81-0x0000000007500000-0x0000000007B7A000-memory.dmp
memory/4560-82-0x0000000006EC0000-0x0000000006EDA000-memory.dmp
memory/4560-70-0x0000000074F60000-0x0000000074FAC000-memory.dmp
memory/4560-23-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/4560-24-0x0000000005510000-0x0000000005576000-memory.dmp
memory/4560-20-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/5108-97-0x0000000006630000-0x00000000067F2000-memory.dmp
memory/5108-57-0x0000000005350000-0x000000000545A000-memory.dmp
memory/5108-56-0x00000000050E0000-0x000000000512C000-memory.dmp
memory/5108-54-0x00000000050A0000-0x00000000050DC000-memory.dmp
memory/5108-53-0x0000000005000000-0x0000000005012000-memory.dmp
memory/5108-52-0x0000000005770000-0x0000000005D88000-memory.dmp
memory/5108-100-0x0000000006BF0000-0x0000000006C0E000-memory.dmp
memory/5108-99-0x0000000006B30000-0x0000000006BA6000-memory.dmp
memory/5108-38-0x0000000000400000-0x000000000041E000-memory.dmp
memory/5108-98-0x0000000006D30000-0x000000000725C000-memory.dmp
memory/5176-49-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/5176-12-0x0000000005EE0000-0x0000000005F40000-memory.dmp
memory/5176-0-0x00000000746DE000-0x00000000746DF000-memory.dmp
memory/5176-7-0x00000000055F0000-0x000000000560A000-memory.dmp
memory/5176-9-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/5176-10-0x0000000005620000-0x000000000562C000-memory.dmp
memory/5176-11-0x0000000005630000-0x0000000005640000-memory.dmp
memory/5176-8-0x00000000746DE000-0x00000000746DF000-memory.dmp
memory/5176-5-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/5176-6-0x0000000005550000-0x00000000055EC000-memory.dmp
memory/5176-4-0x0000000005250000-0x000000000525A000-memory.dmp
memory/5176-3-0x0000000005280000-0x0000000005312000-memory.dmp
memory/5176-2-0x0000000005830000-0x0000000005DD4000-memory.dmp
memory/5176-1-0x00000000007D0000-0x000000000085E000-memory.dmp