Analysis Overview
SHA256
278b095c0694af6600aea03963b86d9b19c2811651ca792508de36c7ec55a250
Threat Level: Known bad
The file 8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe was found to be: Known bad.
Malicious Activity Summary
Redline family
SectopRAT payload
Sectoprat family
SectopRAT
RedLine
RedLine payload
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-12 05:47
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-12 05:47
Reported
2024-11-12 05:49
Platform
win7-20240903-en
Max time kernel
101s
Max time network
110s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Sectoprat family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1964 set thread context of 2684 | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp"
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 45.137.22.248:55615 | tcp | |
| NL | 45.137.22.248:55615 | tcp | |
| NL | 45.137.22.248:55615 | tcp | |
| NL | 45.137.22.248:55615 | tcp |
Files
memory/1964-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp
memory/1964-1-0x0000000000180000-0x000000000020C000-memory.dmp
memory/1964-2-0x0000000073F60000-0x000000007464E000-memory.dmp
memory/1964-3-0x00000000005C0000-0x00000000005DC000-memory.dmp
memory/1964-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp
memory/1964-5-0x0000000073F60000-0x000000007464E000-memory.dmp
memory/1964-6-0x0000000001EF0000-0x0000000001F50000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2YD1DO4OPL1ARJR8BSIX.temp
| MD5 | d1ef371096ca6f26cff982ca0e613ee1 |
| SHA1 | 8b0def53945ce8b04d13cc29ed3992a54ae7fdf0 |
| SHA256 | 3a5dc731db8abaaf140e71fe4fc7b94ed96a1f870133eb0c838785f53d509e8a |
| SHA512 | 2f278bb9c74e506ddedb5e60b462199447b344549f8b110c180bc7324777adc788b23cf29307b20ae36fa09c2540592c1cc3a5aa80e8e7e402ae7dd9df9b5836 |
C:\Users\Admin\AppData\Local\Temp\tmpD7A9.tmp
| MD5 | 6ed3b6f2a93bc16988bf7b2969225602 |
| SHA1 | 81865ce40cf9aaaefe9d4f2fe0030cd981eaeafd |
| SHA256 | 65aee9c20ee0a75b4a7d113d595368edd41a5e527cf268cf479460fa072d9187 |
| SHA512 | 808392c8d39559ec3ca04c445dd592beb77344c6d72e6d4d7fe4b4e2c752d509dfb904de1f6c25a9917206746e85dfee45a56db165a4bcae4acdb9863b9fc5c3 |
memory/2684-19-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-28-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2684-25-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-23-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-21-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-30-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2684-29-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1964-31-0x0000000073F60000-0x000000007464E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-12 05:47
Reported
2024-11-12 05:49
Platform
win10v2004-20241007-en
Max time kernel
103s
Max time network
119s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Redline family
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Sectoprat family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2580 set thread context of 3112 | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HOjwhlbHdhmAQJ.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HOjwhlbHdhmAQJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF40.tmp"
C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe
"C:\Users\Admin\AppData\Local\Temp\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| NL | 45.137.22.248:55615 | tcp | |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| NL | 45.137.22.248:55615 | tcp | |
| NL | 45.137.22.248:55615 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| NL | 45.137.22.248:55615 | tcp |
Files
memory/2580-0-0x000000007450E000-0x000000007450F000-memory.dmp
memory/2580-1-0x0000000000950000-0x00000000009DC000-memory.dmp
memory/2580-2-0x0000000005A90000-0x0000000006034000-memory.dmp
memory/2580-3-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/2580-4-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2580-5-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/2580-6-0x00000000056B0000-0x000000000574C000-memory.dmp
memory/2580-7-0x0000000005A40000-0x0000000005A5C000-memory.dmp
memory/2580-8-0x000000007450E000-0x000000007450F000-memory.dmp
memory/2580-9-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2580-10-0x0000000002C40000-0x0000000002CA0000-memory.dmp
memory/2372-15-0x00000000048E0000-0x0000000004916000-memory.dmp
memory/2372-17-0x0000000004F50000-0x0000000005578000-memory.dmp
memory/2372-18-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2372-16-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2372-19-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/2372-20-0x0000000004DA0000-0x0000000004DC2000-memory.dmp
memory/2372-23-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/2372-22-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/1924-21-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1924-25-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1924-24-0x0000000006290000-0x00000000065E4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tg5r43fk.2gh.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1924-44-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/3112-46-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2580-48-0x0000000074500000-0x0000000074CB0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8d6eb147e9f5a3b0982844feda99dfb8572c1c9ae05e06248b012fc7e3f90d95N.exe.log
| MD5 | 8ec831f3e3a3f77e4a7b9cd32b48384c |
| SHA1 | d83f09fd87c5bd86e045873c231c14836e76a05c |
| SHA256 | 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982 |
| SHA512 | 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3 |
C:\Users\Admin\AppData\Local\Temp\tmpCF40.tmp
| MD5 | c1aff092b811d9caeaab0c4dcdfb7c89 |
| SHA1 | c44f29b4e07108e01825aa75033bd8154c0ebcc2 |
| SHA256 | c8c45c85b7105c86101281c836a25363db04aa1765d6f6b2ea41e8df38538e77 |
| SHA512 | 7bffaee6cd9efbfa3eb0a577a68ff4d0d5fdd6e56cacd905c706be014e426b300f45cb3b97679cff33a08d0e17fd0a0f9046bc23659d4cd7fa04372c38d415d8 |
memory/3112-51-0x00000000051D0000-0x00000000051E2000-memory.dmp
memory/3112-52-0x0000000005230000-0x000000000526C000-memory.dmp
memory/3112-50-0x0000000005930000-0x0000000005F48000-memory.dmp
memory/3112-53-0x0000000005270000-0x00000000052BC000-memory.dmp
memory/1924-54-0x0000000006950000-0x000000000696E000-memory.dmp
memory/3112-55-0x00000000054E0000-0x00000000055EA000-memory.dmp
memory/1924-57-0x0000000074D90000-0x0000000074DDC000-memory.dmp
memory/1924-56-0x00000000078F0000-0x0000000007922000-memory.dmp
memory/1924-77-0x0000000006F00000-0x0000000006F1E000-memory.dmp
memory/2372-67-0x0000000074D90000-0x0000000074DDC000-memory.dmp
memory/1924-78-0x0000000007930000-0x00000000079D3000-memory.dmp
memory/2372-79-0x00000000077E0000-0x0000000007E5A000-memory.dmp
memory/1924-80-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/2372-81-0x0000000007210000-0x000000000721A000-memory.dmp
memory/1924-82-0x0000000007F00000-0x0000000007F96000-memory.dmp
memory/1924-83-0x0000000007E80000-0x0000000007E91000-memory.dmp
memory/1924-84-0x0000000007EB0000-0x0000000007EBE000-memory.dmp
memory/2372-85-0x00000000073E0000-0x00000000073F4000-memory.dmp
memory/2372-86-0x00000000074E0000-0x00000000074FA000-memory.dmp
memory/2372-87-0x00000000074C0000-0x00000000074C8000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7e05964aa2a861dafc57961a7dbab6e8 |
| SHA1 | 38e91b9082086c97b960dd8f4fbc92f0f0d51569 |
| SHA256 | 3989465492296f4ca4fbd60d29cd923633ea494744ea2cc6c09744b9dcc30c88 |
| SHA512 | be98bbed7753c95fa0a5105e681d06ac125f8410a92063d9564376dcc21d4d3a63b98806c3f210c018c82db44242f83e0041463958c25888a1fe41808acdaf64 |
memory/2372-93-0x0000000074500000-0x0000000074CB0000-memory.dmp
memory/1924-94-0x0000000074500000-0x0000000074CB0000-memory.dmp