Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 02:11

General

  • Target

    236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe

  • Size

    541KB

  • MD5

    616b97038b6328ae6e45a08077df4a7a

  • SHA1

    11473c1f0515f06579e7704dc036bbc620c7510a

  • SHA256

    236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6

  • SHA512

    4730733b4be691840fa1905fc4bfeeeba7ebb06e10d24cfe78a285a3e518a2f2ba31bbc378cda68edf4311df322fd137ed1f65d4b844737e9f0df547506c04e0

  • SSDEEP

    12288:vNpszYhvXWSVJdMaeaxxJHuT8DmP79TovFZFW84:FhvJVJdMQPuTVP792gR

Malware Config

Extracted

Family

redline

Botnet

@Seno_47

C2

45.81.227.32:22625

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 2 IoCs
  • Sectoprat family
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe
    "C:\Users\Admin\AppData\Local\Temp\236020bb910e3cfd1e03bff5722204be40c0739fb6d2954b35c8b02185e37ef6.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Users\Admin\AppData\Roaming\output.exe
      "C:\Users\Admin\AppData\Roaming\output.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\KptpDogTJSrhyBmYndFbaBLc.exe
        "C:\Users\Admin\AppData\Local\Temp\KptpDogTJSrhyBmYndFbaBLc.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\KptpDogTJSrhyBmYndFbaBLc.exe

    Filesize

    97KB

    MD5

    f4bbbbd0c06b5b5f46386ad1db6227b0

    SHA1

    5a026b7ed8c49b1213a6393e938c91399ff33eb8

    SHA256

    3783dda749b402ddb2065d6830dc3d7d2771b4b8dc02358efe64947205b2517d

    SHA512

    3a7554883cf3c729a1f249eff33e3ad5de69be174971209e536d7d2c829d50bc9666391e9663db782eb445f8e8f87c81ac7b0248faff2f2e594909bbd84f5d48

  • C:\Users\Admin\AppData\Roaming\output.exe

    Filesize

    269KB

    MD5

    2f376ad2903620fd9f52c4d8af903777

    SHA1

    726ecc2dff7d3af1b4d03591761183f70c9a1242

    SHA256

    e60ab1c5095002e6ed227251cfc4c4124db13255af95b6b76405e44e7a750215

    SHA512

    75fbb18d81c022bef30887718da799ffd77c462ef324b9975bd3815b7af5b759e70858a9e0f472b9bedd0af3c90a05df02fd3f6c492fea802e12c719ad2dd0eb

  • memory/628-27-0x00000000052A0000-0x0000000005844000-memory.dmp

    Filesize

    5.6MB

  • memory/628-31-0x0000000004F30000-0x0000000004F6C000-memory.dmp

    Filesize

    240KB

  • memory/628-36-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/628-24-0x00000000003C0000-0x00000000003DE000-memory.dmp

    Filesize

    120KB

  • memory/628-35-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/628-26-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/628-34-0x00000000076F0000-0x00000000077FA000-memory.dmp

    Filesize

    1.0MB

  • memory/628-28-0x0000000005E70000-0x0000000006488000-memory.dmp

    Filesize

    6.1MB

  • memory/628-30-0x0000000004DF0000-0x0000000004E02000-memory.dmp

    Filesize

    72KB

  • memory/628-29-0x0000000004E50000-0x0000000004EE2000-memory.dmp

    Filesize

    584KB

  • memory/628-33-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/628-32-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

    Filesize

    304KB

  • memory/2336-11-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-9-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

    Filesize

    4KB

  • memory/2336-25-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-10-0x0000000000320000-0x0000000000368000-memory.dmp

    Filesize

    288KB