Overview
overview
10Static
static
10Bird.exe
windows7-x64
10Bird.exe
windows10-2004-x64
10CSGO FREE HACK.exe
windows7-x64
10CSGO FREE HACK.exe
windows10-2004-x64
10CSGO FREEHACK.exe
windows7-x64
3CSGO FREEHACK.exe
windows10-2004-x64
3CSGhost-v4.1.exe
windows7-x64
8CSGhost-v4.1.exe
windows10-2004-x64
10Install.exe
windows7-x64
10Install.exe
windows10-2004-x64
10Installer.exe
windows7-x64
10Installer.exe
windows10-2004-x64
10Installer2.exe
windows7-x64
10Installer2.exe
windows10-2004-x64
10Kiddions Mod MENU.exe
windows7-x64
7Kiddions Mod MENU.exe
windows10-2004-x64
7Minecraft_v4.5.exe
windows7-x64
10Minecraft_v4.5.exe
windows10-2004-x64
10Vape Crack.exe
windows7-x64
10Vape Crack.exe
windows10-2004-x64
10Vape Patch.exe
windows7-x64
10Vape Patch.exe
windows10-2004-x64
10Vape_V4.exe
windows7-x64
10Vape_V4.exe
windows10-2004-x64
10launcher.exe
windows7-x64
10launcher.exe
windows10-2004-x64
10nixware crack.exe
windows7-x64
3nixware crack.exe
windows10-2004-x64
3Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 16:28
Behavioral task
behavioral1
Sample
Bird.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Bird.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
CSGO FREE HACK.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CSGO FREE HACK.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
CSGO FREEHACK.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
CSGO FREEHACK.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
CSGhost-v4.1.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
CSGhost-v4.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Install.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Install.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Installer.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Installer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Installer2.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Installer2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Kiddions Mod MENU.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Kiddions Mod MENU.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Minecraft_v4.5.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Minecraft_v4.5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Vape Crack.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Vape Crack.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Vape Patch.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Vape Patch.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Vape_V4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Vape_V4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
launcher.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
nixware crack.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
nixware crack.exe
Resource
win10v2004-20241007-en
General
-
Target
launcher.exe
-
Size
378KB
-
MD5
36aeb708e396c2627e52d8c50d8ea287
-
SHA1
e1bd5ab1cb291915db4e3d03b0e88b4dc737f53a
-
SHA256
b35f6e33f997d11867056950aae71610d3bbef64eb443db3aed8a49cc850e226
-
SHA512
1ad276b880dd136f4364ccf0361d8ef3c790a6f178c39f1fd0c365b93f789595c7060f90020b7b4f0592a3c0f64444b194c83fc7652ffbad3afa5f14b8574a6d
-
SSDEEP
6144:OthUfR1Gfk0EAspZJVN9htIBVnUxFMO8F/vZmMYGhwPgL9x4mN:OthsR1Gfk0EAsZVN9htIBVnUxFMO8F/f
Malware Config
Extracted
redline
@killyxu
3.68.106.170:59223
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral26/memory/2844-6-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule behavioral26/memory/2844-6-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2204 set thread context of 2844 2204 launcher.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launcher.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2844 launcher.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2000 2204 launcher.exe 87 PID 2204 wrote to memory of 2000 2204 launcher.exe 87 PID 2204 wrote to memory of 2000 2204 launcher.exe 87 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91 PID 2204 wrote to memory of 2844 2204 launcher.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\launcher.exeC:\Users\Admin\AppData\Local\Temp\launcher.exe2⤵PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\launcher.exeC:\Users\Admin\AppData\Local\Temp\launcher.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700B
MD5e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827