Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 06:43

General

  • Target

    8601b9efdac4733e888cc949f337cfbba4140a6a441aaefe2ab391b4d637dfbc.exe

  • Size

    1.3MB

  • MD5

    b4138222931b8458a109d11cd2194ce8

  • SHA1

    3b78247eea213f18d0fa745860b3099238b31fe9

  • SHA256

    8601b9efdac4733e888cc949f337cfbba4140a6a441aaefe2ab391b4d637dfbc

  • SHA512

    8b7f99577a57e42fd9e302ed979a940fc6e64bdc6457866702af44272223c439e5128461120c68b88eed8d6d5257b7e29eb4625a62d9680cd2cf29feff3392bb

  • SSDEEP

    24576:dpxRSasbbtRTnQ5sUm0n0m4DH5fS9Mr9CKkMcvBJsJYs45Z3S8IVej:dpfSamk5sUm0nXsCMkDBU16Z3w

Malware Config

Extracted

Family

redline

Botnet

HWID-SPOOFER

C2

amrican-sport-live-stream.cc:4581

Attributes
  • auth_value

    82cc1998a304a60caeeadbaf5bb109cb

Signatures

  • Detect PureCrypter injector 34 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Purecrypter family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8601b9efdac4733e888cc949f337cfbba4140a6a441aaefe2ab391b4d637dfbc.exe
    "C:\Users\Admin\AppData\Local\Temp\8601b9efdac4733e888cc949f337cfbba4140a6a441aaefe2ab391b4d637dfbc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
        PID:932
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1432

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1432-10172-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/1432-10173-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB

    • memory/1432-10175-0x0000000002C40000-0x0000000002C46000-memory.dmp

      Filesize

      24KB

    • memory/1432-10176-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB

    • memory/1432-10177-0x000000000B120000-0x000000000B738000-memory.dmp

      Filesize

      6.1MB

    • memory/1432-10182-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB

    • memory/1432-10181-0x0000000004D80000-0x0000000004DCC000-memory.dmp

      Filesize

      304KB

    • memory/1432-10180-0x000000000AC10000-0x000000000AC4C000-memory.dmp

      Filesize

      240KB

    • memory/1432-10179-0x000000000ABB0000-0x000000000ABC2000-memory.dmp

      Filesize

      72KB

    • memory/1432-10178-0x000000000AC80000-0x000000000AD8A000-memory.dmp

      Filesize

      1.0MB

    • memory/4592-37-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-21-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-33-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-51-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-54-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-67-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-65-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-63-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-61-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-59-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-57-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-55-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-49-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-47-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-45-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-43-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-41-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-39-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-17-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-35-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-31-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-27-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-23-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-29-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-19-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-25-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-15-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-9-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-7-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-5-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-4-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-11-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-2785-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

      Filesize

      4KB

    • memory/4592-3152-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-10164-0x0000000005D10000-0x0000000005D32000-memory.dmp

      Filesize

      136KB

    • memory/4592-10165-0x0000000006100000-0x0000000006454000-memory.dmp

      Filesize

      3.3MB

    • memory/4592-10166-0x0000000005FE0000-0x0000000006046000-memory.dmp

      Filesize

      408KB

    • memory/4592-10167-0x0000000034710000-0x00000000347A2000-memory.dmp

      Filesize

      584KB

    • memory/4592-13-0x00000000055D0000-0x000000000584F000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-3-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-2-0x00000000055D0000-0x0000000005856000-memory.dmp

      Filesize

      2.5MB

    • memory/4592-1-0x0000000000B70000-0x0000000000CBC000-memory.dmp

      Filesize

      1.3MB

    • memory/4592-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

      Filesize

      4KB

    • memory/4592-10168-0x0000000034D60000-0x0000000035304000-memory.dmp

      Filesize

      5.6MB

    • memory/4592-10169-0x0000000006460000-0x00000000064C0000-memory.dmp

      Filesize

      384KB

    • memory/4592-10174-0x0000000074E90000-0x0000000075640000-memory.dmp

      Filesize

      7.7MB