Analysis
- max time kernel
136s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
01/09/2024, 01:43
General
- Target db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe
- Size 518KB
- Sample240901-b5d3dsyaka
- SHA256 db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128
Malware Config
Extracted
-
redline
-
cheat
-
45.137.22.239:55615
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe"C:\Users\Admin\AppData\Local\Temp\db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VzwumYUBCtHW.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VzwumYUBCtHW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE8B.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe"C:\Users\Admin\AppData\Local\Temp\db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
db6a579ef546405d1c3e44a5f1637bc402136315ce4814d53aa926056f680128.exe.log
__PSScriptPolicyTest_pzidtqui.kqp.ps1
tmpCE8B.tmp
memory/3232-68-0x0000000074D80000-0x0000000074DCC000-memory.dmp
memory/3232-18-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3232-89-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3232-85-0x0000000007B50000-0x0000000007B6A000-memory.dmp
memory/3232-84-0x0000000007A50000-0x0000000007A64000-memory.dmp
memory/3232-79-0x0000000007810000-0x000000000782A000-memory.dmp
memory/3232-78-0x0000000007E50000-0x00000000084CA000-memory.dmp
memory/3232-81-0x0000000007A90000-0x0000000007B26000-memory.dmp
memory/3232-20-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3232-16-0x0000000002BD0000-0x0000000002C06000-memory.dmp
memory/3232-17-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3232-19-0x0000000005590000-0x0000000005BB8000-memory.dmp
memory/3956-67-0x0000000007890000-0x0000000007933000-memory.dmp
memory/3956-53-0x0000000006710000-0x000000000675C000-memory.dmp
memory/3956-21-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3956-83-0x0000000007BF0000-0x0000000007BFE000-memory.dmp
memory/3956-23-0x0000000005700000-0x0000000005722000-memory.dmp
memory/3956-82-0x0000000007BC0000-0x0000000007BD1000-memory.dmp
memory/3956-25-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/3956-24-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/3956-44-0x0000000006040000-0x0000000006394000-memory.dmp
memory/3956-80-0x0000000007A40000-0x0000000007A4A000-memory.dmp
memory/3956-66-0x0000000007860000-0x000000000787E000-memory.dmp
memory/3956-56-0x0000000074D80000-0x0000000074DCC000-memory.dmp
memory/3956-55-0x0000000007620000-0x0000000007652000-memory.dmp
memory/3956-90-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/3956-86-0x0000000007CE0000-0x0000000007CE8000-memory.dmp
memory/3956-52-0x0000000006670000-0x000000000668E000-memory.dmp
memory/4696-47-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/4696-5-0x0000000005000000-0x000000000500A000-memory.dmp
memory/4696-10-0x00000000061D0000-0x0000000006230000-memory.dmp
memory/4696-3-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/4696-4-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/4696-0-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/4696-7-0x00000000066C0000-0x00000000066D8000-memory.dmp
memory/4696-9-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/4696-8-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/4696-11-0x0000000008B00000-0x0000000008B9C000-memory.dmp
memory/4696-6-0x0000000006640000-0x00000000066C2000-memory.dmp
memory/4696-2-0x0000000005520000-0x0000000005AC4000-memory.dmp
memory/4696-1-0x00000000006A0000-0x0000000000722000-memory.dmp
memory/4760-45-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4760-50-0x0000000002C20000-0x0000000002C32000-memory.dmp
memory/4760-54-0x0000000005490000-0x000000000559A000-memory.dmp
memory/4760-51-0x00000000051E0000-0x000000000521C000-memory.dmp
memory/4760-49-0x0000000005970000-0x0000000005F88000-memory.dmp