Analysis
- max time kernel
142s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
22/10/2024, 01:41
General
- Target 9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe
- Size 763KB
- Sample241022-b346ss1fml
- SHA256 9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6
Malware Config
Extracted
-
xworm
-
5.0
-
162.251.122.86:57903
-
fCXrE8L4kRTm48Ov
-
install_file
USB.exe
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot7388739443:AAGtGEMG0kgDM1V9rPLWCt4i7ndysEwwYBA/sendMessage?chat_id=1224745150
-
https://api.telegram.org/bot7260827022:AAGnycbSxkSvowZMOoJ8zZlGOgV2Qx7LfZI/sendMessage?chat_id=6487984800
Extracted
-
redline
-
success
-
162.251.122.86:5798
Signatures
- Detect Xworm Payload 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Xworm
Xworm is a remote access trojan written in C#.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\arrogatingly\pteropod.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\9378bcf50d0a58428c5b2f7fd2284579927a48fd2e9d8f4f8395f932cb3db1a6.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
pteropod.exe
memory/3924-20-0x000000007505E000-0x000000007505F000-memory.dmp
memory/3924-17-0x0000000075050000-0x0000000075800000-memory.dmp
memory/3924-12-0x00000000003D0000-0x00000000003E0000-memory.dmp
memory/3924-13-0x000000007505E000-0x000000007505F000-memory.dmp
memory/3924-14-0x0000000004D00000-0x0000000004D9C000-memory.dmp
memory/3924-15-0x0000000005650000-0x0000000005BF4000-memory.dmp
memory/3924-21-0x0000000075050000-0x0000000075800000-memory.dmp
memory/3924-16-0x0000000005CA0000-0x0000000005D32000-memory.dmp
memory/3924-18-0x0000000005640000-0x000000000564A000-memory.dmp
memory/3924-19-0x0000000005EA0000-0x0000000005F06000-memory.dmp
memory/3924-34-0x0000000075050000-0x0000000075800000-memory.dmp
memory/3924-32-0x00000000085A0000-0x0000000008ACC000-memory.dmp
memory/3924-26-0x0000000006F80000-0x0000000006F92000-memory.dmp
memory/3924-22-0x0000000006A30000-0x0000000006A82000-memory.dmp
memory/3924-24-0x00000000076B0000-0x0000000007CC8000-memory.dmp
memory/3924-25-0x0000000007090000-0x000000000719A000-memory.dmp
memory/3924-23-0x0000000006A80000-0x0000000006ACA000-memory.dmp
memory/3924-27-0x0000000006FE0000-0x000000000701C000-memory.dmp
memory/3924-28-0x0000000007020000-0x000000000706C000-memory.dmp
memory/3924-29-0x0000000007470000-0x00000000074BA000-memory.dmp
memory/3924-30-0x0000000007EA0000-0x0000000008062000-memory.dmp
memory/3924-31-0x00000000075D0000-0x0000000007620000-memory.dmp
memory/4284-10-0x0000000003B60000-0x0000000003D60000-memory.dmp
memory/4968-2-0x0000000003FE0000-0x00000000041E0000-memory.dmp