Overview
overview
10Static
static
10Bird.exe
windows7-x64
10Bird.exe
windows10-2004-x64
10CSGO FREE HACK.exe
windows7-x64
10CSGO FREE HACK.exe
windows10-2004-x64
10CSGO FREEHACK.exe
windows7-x64
3CSGO FREEHACK.exe
windows10-2004-x64
3CSGhost-v4.1.exe
windows7-x64
8CSGhost-v4.1.exe
windows10-2004-x64
10Install.exe
windows7-x64
10Install.exe
windows10-2004-x64
10Installer.exe
windows7-x64
10Installer.exe
windows10-2004-x64
10Installer2.exe
windows7-x64
10Installer2.exe
windows10-2004-x64
10Kiddions Mod MENU.exe
windows7-x64
7Kiddions Mod MENU.exe
windows10-2004-x64
7Minecraft_v4.5.exe
windows7-x64
10Minecraft_v4.5.exe
windows10-2004-x64
10Vape Crack.exe
windows7-x64
10Vape Crack.exe
windows10-2004-x64
10Vape Patch.exe
windows7-x64
10Vape Patch.exe
windows10-2004-x64
10Vape_V4.exe
windows7-x64
10Vape_V4.exe
windows10-2004-x64
10launcher.exe
windows7-x64
10launcher.exe
windows10-2004-x64
10nixware crack.exe
windows7-x64
3nixware crack.exe
windows10-2004-x64
3Analysis
-
max time kernel
137s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 16:28
Behavioral task
behavioral1
Sample
Bird.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Bird.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
CSGO FREE HACK.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CSGO FREE HACK.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
CSGO FREEHACK.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
CSGO FREEHACK.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
CSGhost-v4.1.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
CSGhost-v4.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Install.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Install.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Installer.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Installer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer2.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Installer2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Kiddions Mod MENU.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Kiddions Mod MENU.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Minecraft_v4.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Minecraft_v4.5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Vape Crack.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Vape Crack.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Vape Patch.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Vape Patch.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Vape_V4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Vape_V4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
launcher.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
nixware crack.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
nixware crack.exe
Resource
win10v2004-20241007-en
General
-
Target
launcher.exe
-
Size
378KB
-
MD5
36aeb708e396c2627e52d8c50d8ea287
-
SHA1
e1bd5ab1cb291915db4e3d03b0e88b4dc737f53a
-
SHA256
b35f6e33f997d11867056950aae71610d3bbef64eb443db3aed8a49cc850e226
-
SHA512
1ad276b880dd136f4364ccf0361d8ef3c790a6f178c39f1fd0c365b93f789595c7060f90020b7b4f0592a3c0f64444b194c83fc7652ffbad3afa5f14b8574a6d
-
SSDEEP
6144:OthUfR1Gfk0EAspZJVN9htIBVnUxFMO8F/vZmMYGhwPgL9x4mN:OthsR1Gfk0EAsZVN9htIBVnUxFMO8F/f
Malware Config
Extracted
redline
@killyxu
3.68.106.170:59223
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral25/memory/2220-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2220-13-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2220-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2220-9-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral25/memory/2220-5-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 5 IoCs
resource yara_rule behavioral25/memory/2220-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral25/memory/2220-13-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral25/memory/2220-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral25/memory/2220-9-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral25/memory/2220-5-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2124 set thread context of 2220 2124 launcher.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launcher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2220 launcher.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31 PID 2124 wrote to memory of 2220 2124 launcher.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\launcher.exeC:\Users\Admin\AppData\Local\Temp\launcher.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2220
-