Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 16:28

General

  • Target

    Minecraft_v4.5.exe

  • Size

    1.3MB

  • MD5

    95692ea1f96acdc98fe565323e8a85e3

  • SHA1

    f51b89233440a81d86295074fbfb3d2958d49325

  • SHA256

    df3731e797b1f9dc07e772747e9fb1a2ca62ca7c8823f3df96eb8c20f6ee0912

  • SHA512

    1699d38a87b219b8c33c8ad6a77f2122e71b97d587d8f76b1657e8db76c606fae5d8a38bacd7d61fee3c5a889c6059a82f6cbe6a08c2d1db3773b7d843b4026a

  • SSDEEP

    12288:e8PUAoMZQaktUC04YqZrkPrkxChx4S95dmWT:eW/x6o4fZgPrkxChx4I5dvT

Malware Config

Extracted

Family

redline

Botnet

boss9

C2

109.248.201.150:63757

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe
      "C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe"
      2⤵
        PID:3132
      • C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe
        "C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe"
        2⤵
          PID:1616
        • C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe
          "C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.5.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2180

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Minecraft_v4.5.exe.log

        Filesize

        1KB

        MD5

        fb3264819f05b468156e37fecd7ca1e7

        SHA1

        8461be627ec2c21766472ac5a9215204f6cd03d6

        SHA256

        902e22368b4d29d67c78eb445d67c7e36001a79c7701a1e171a9c7af457a739c

        SHA512

        ddcb2a199799dc30a5627d6bb2aff30aca350b52e15f574ecc9e9e9e4d388fd1fe808b5fd2a8ea7015c91e369a06f045be455bf070c6d20d8c3b1c06de8ef964

      • memory/2180-11-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/2180-22-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2180-21-0x00000000054E0000-0x00000000055EA000-memory.dmp

        Filesize

        1.0MB

      • memory/2180-20-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2180-19-0x0000000005270000-0x00000000052BC000-memory.dmp

        Filesize

        304KB

      • memory/2180-18-0x0000000005230000-0x000000000526C000-memory.dmp

        Filesize

        240KB

      • memory/2180-16-0x0000000005790000-0x0000000005DA8000-memory.dmp

        Filesize

        6.1MB

      • memory/2180-17-0x00000000051D0000-0x00000000051E2000-memory.dmp

        Filesize

        72KB

      • memory/2180-15-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2996-4-0x00000000056C0000-0x00000000056CA000-memory.dmp

        Filesize

        40KB

      • memory/2996-10-0x0000000005860000-0x000000000587E000-memory.dmp

        Filesize

        120KB

      • memory/2996-13-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2996-9-0x00000000057E0000-0x0000000005856000-memory.dmp

        Filesize

        472KB

      • memory/2996-8-0x0000000005740000-0x0000000005762000-memory.dmp

        Filesize

        136KB

      • memory/2996-7-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2996-6-0x00000000753AE000-0x00000000753AF000-memory.dmp

        Filesize

        4KB

      • memory/2996-0-0x00000000753AE000-0x00000000753AF000-memory.dmp

        Filesize

        4KB

      • memory/2996-5-0x00000000753A0000-0x0000000075B50000-memory.dmp

        Filesize

        7.7MB

      • memory/2996-3-0x0000000005600000-0x0000000005692000-memory.dmp

        Filesize

        584KB

      • memory/2996-2-0x0000000005B10000-0x00000000060B4000-memory.dmp

        Filesize

        5.6MB

      • memory/2996-1-0x0000000000AD0000-0x0000000000C14000-memory.dmp

        Filesize

        1.3MB