0e486871aeddade1498c575341b53401d74af20bf4cf9103b8d1f9596d852673

Analysis

max time kernel
422s
max time network
1144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 04:00

Target

Redlinestealer2020-main/OpenPort.bat
Size

94B
MD5

cf1cc90281e28cee22dce7ed013c2678
SHA1

2f213a71b76db3e51ad2d659f84dc1f3f90725fb
SHA256

84399f8bccefa404e156a5351b1de75a2d5290b4fddd1754efb16401ed7218ef
SHA512

2b61c1da7cc66506537719cedab82f172d2ac1af4df69513ba64507a5ed67989974f81791faf08c5855580df53f564600381be34c340b825f1f01919948921e1

Score

8^/10

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

Disable or Modify System Firewall

pid	Process
4212	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4212	772	cmd.exe	85
PID 772 wrote to memory of 4212	772	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Redlinestealer2020-main\OpenPort.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="RLS" dir=in action=allow protocol=TCP localport=6677
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4212