Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 16:28

General

  • Target

    Vape Crack.exe

  • Size

    356KB

  • MD5

    179dbbdb6e22f978115168d87a70ab33

  • SHA1

    324a73e17fdcada034d3ad841286f9d6b5873fcb

  • SHA256

    258445b5c086f67d1157c2998968bad83a64ca3bab88bfd9d73654819bb46463

  • SHA512

    237a58b819f086f9ed2215e99d7b13ed027d252e47a3ba17deb5b28e3db27f853f2d2d75bdbfb3b875dec8dc0fa4fb059e3be6e41dc3b47b2020c2298a6b0358

  • SSDEEP

    6144:zo9QlVmhcIS/rwO+l7qYspB2NnYXmJ8tuy2a9W17fyF45pDBKoydJ:zdxrwHRqxQNYXO8tt2aw1DyWPDO

Malware Config

Extracted

Family

redline

Botnet

@bestiefFcs

C2

37.1.213.214:63028

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vape Crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Vape Crack.exe"
    1⤵
    • System Binary Proxy Execution: Regsvcs/Regasm
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1200
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2988
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:11756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KRC02O6IUKGLZGQQE61M.temp

    Filesize

    7KB

    MD5

    17984f44880547c633aaa045d4cc8d28

    SHA1

    018ef977dce56c2b143228f334002a87f7d1bb31

    SHA256

    91349d976beb92ff111f28f378d7853e69287d6bf6a39e4a2444390df715300b

    SHA512

    b7a44e89ccba516be6440992c9c1423f57b50d12d2de681f6eaa166116f070c4c6a735e47e7c45d639dd64a425c93c79d8463f7eeed885c97f8dfc3bdc3bf0d6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    bad4aa35d2377b6a2906fadea728c258

    SHA1

    813663aabd6cd88bdff1958e48b950dea5a19046

    SHA256

    70c07d9167df0163ef649aae6c055c0504eb6dfc77755603cc8440d118aac3e5

    SHA512

    93a102a177a5ecf6b6f58543d712e579505eb231542858dbe078ab46c3c971b11ccf461ea41a0bae8d7efdfb5f2f0e3683eb214dbd889da9ac562c5de383a6fe

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe

    Filesize

    63KB

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/1200-5-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/1636-56-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-78-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-48-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-13-0x0000000004050000-0x00000000040A6000-memory.dmp

    Filesize

    344KB

  • memory/1636-14-0x0000000004FC0000-0x0000000005040000-memory.dmp

    Filesize

    512KB

  • memory/1636-40-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-50-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-76-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-74-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-72-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-70-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-52-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-66-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-64-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-62-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-60-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-58-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

    Filesize

    4KB

  • memory/1636-54-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-68-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-7-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-6-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

    Filesize

    4KB

  • memory/1636-46-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-44-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-42-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-38-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-36-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-34-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-32-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-30-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-28-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-26-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-24-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-22-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-20-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-18-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-16-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-15-0x0000000004FC0000-0x000000000503A000-memory.dmp

    Filesize

    488KB

  • memory/1636-1-0x0000000000350000-0x00000000003AC000-memory.dmp

    Filesize

    368KB

  • memory/1636-2517-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/11756-2516-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB