Analysis
- max time kernel
96s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
12/09/2024, 05:53
General
- Target RFQ-Al NASR-00388.exe
- Size 1.3MB
- Sample240912-glathsthrc
- SHA256 24985d941556f95dd3a91d2451d11d91af5633f618cd49a6a4ae31ece2dce41e
Malware Config
Extracted
-
redline
-
lovato
-
57.128.132.216:55123
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-Al NASR-00388.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpC98B.tmp
tmpC9A0.tmp
tmpC9CB.tmp
tmpC9E1.tmp
tmpC9F7.tmp
tmpCA32.tmp
memory/3896-0-0x00007FF999443000-0x00007FF999445000-memory.dmp
memory/3896-2-0x00007FF999440000-0x00007FF999F01000-memory.dmp
memory/3896-3-0x000001459D4C0000-0x000001459D530000-memory.dmp
memory/3896-1-0x000001459D0A0000-0x000001459D0B8000-memory.dmp
memory/3896-9-0x00007FF999440000-0x00007FF999F01000-memory.dmp
memory/4852-7-0x00000000053F0000-0x0000000005402000-memory.dmp
memory/4852-11-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/4852-13-0x00000000067A0000-0x0000000006962000-memory.dmp
memory/4852-14-0x0000000006EA0000-0x00000000073CC000-memory.dmp
memory/4852-15-0x00000000066F0000-0x0000000006756000-memory.dmp
memory/4852-16-0x0000000006BF0000-0x0000000006C66000-memory.dmp
memory/4852-17-0x0000000006D10000-0x0000000006DA2000-memory.dmp
memory/4852-18-0x0000000007980000-0x0000000007F24000-memory.dmp
memory/4852-19-0x0000000006E40000-0x0000000006E5E000-memory.dmp
memory/4852-12-0x0000000005700000-0x000000000580A000-memory.dmp
memory/4852-10-0x00000000054D0000-0x000000000551C000-memory.dmp
memory/4852-8-0x0000000005450000-0x000000000548C000-memory.dmp
memory/4852-6-0x0000000005AF0000-0x0000000006108000-memory.dmp
memory/4852-5-0x000000007522E000-0x000000007522F000-memory.dmp
memory/4852-4-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4852-186-0x000000007522E000-0x000000007522F000-memory.dmp
memory/4852-187-0x0000000075220000-0x00000000759D0000-memory.dmp
memory/4852-189-0x0000000075220000-0x00000000759D0000-memory.dmp