Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/11/2024, 02:11

General

  • Target

    25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe

  • Size

    405KB

  • MD5

    bf2e00fc28e5f89ec6b3b457a5a245fb

  • SHA1

    d42962e2e987c4cd8201badf832f3368afb09d24

  • SHA256

    25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560

  • SHA512

    e1f61fec329fab9f0bd997e7b34945e156475a53531c30630a03c550e60c029627e5697c5efb6a0a81b2bc23e178264aabfb26c8b68153d7107d367035730b2a

  • SSDEEP

    12288:wa8EKlXgFxY3wBeTLDQknVwtw/eMTM6fXgyyC5Te4A6:wDQkqm7nwHC5ZA

Malware Config

Extracted

Family

redline

Botnet

@Fanat_022

C2

152.228.150.198:11188

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Sectoprat family
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
    "C:\Users\Admin\AppData\Local\Temp\25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dktqSaBDU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AC1.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3028
    • C:\Users\Admin\AppData\Local\Temp\25dc70a3def65cca61f30ad3a818edbf0dcebbf8257a302212fd7424cc7e8560.exe
      "{path}"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1AC1.tmp

    Filesize

    1KB

    MD5

    8d1b43491346cb2998697c21872bf201

    SHA1

    523d971be9c09e24857cf7e4f4474c4334d51197

    SHA256

    833d1c00c94f159b5ba24db5273b431f9373448783e77c710b8fc7f962baa620

    SHA512

    ed91f913d3b1621353cfb136c9091d55761fc45a36282131d743867760e3ec9a6c49999d3528280f5e35712619d0567d1fb47d389849de9d1496a147e62737b2

  • memory/2520-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

    Filesize

    4KB

  • memory/2520-1-0x00000000000C0000-0x000000000012C000-memory.dmp

    Filesize

    432KB

  • memory/2520-2-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-3-0x0000000000520000-0x0000000000528000-memory.dmp

    Filesize

    32KB

  • memory/2520-4-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2520-5-0x0000000004EC0000-0x0000000004F38000-memory.dmp

    Filesize

    480KB

  • memory/2520-6-0x0000000000680000-0x00000000006AA000-memory.dmp

    Filesize

    168KB

  • memory/2520-25-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-23-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-14-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-20-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-18-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2764-15-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-10-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-24-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-12-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2764-26-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-27-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-28-0x0000000074CA0000-0x000000007538E000-memory.dmp

    Filesize

    6.9MB