Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 12:16
Static task
static1
Behavioral task
behavioral1
Sample
3D63B777F65056B236BA51180CD37CE0.exe
Resource
win7-20240903-en
General
-
Target
3D63B777F65056B236BA51180CD37CE0.exe
-
Size
557KB
-
MD5
3d63b777f65056b236ba51180cd37ce0
-
SHA1
94a4653797f942c4f2eb1ac36707d66e5cef401f
-
SHA256
d2ddb7d466186ab167e6799198ef76d678ad0ac098a5deacb5a99383aa54b717
-
SHA512
10b6f38a651593a7fbb2209907b4ce16bfccb07db858dd826f27d3a5b8270cf4b09b4a54233e2804d3fcd909f775b5e5c85c0b6923ec65afbf767e46a341a37e
-
SSDEEP
12288:5JjHQC3RbeXNMR4xfLH4mU7D+MCyWQNIQTkduiY0D:5tQC35eXN/fLo+MrWQNxkQiBD
Malware Config
Extracted
redline
cheat
185.222.58.82:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/1032-15-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1032-12-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1032-11-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1032-19-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1032-17-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/1032-15-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1032-12-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1032-11-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1032-19-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1032-17-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D63B777F65056B236BA51180CD37CE0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1732 3D63B777F65056B236BA51180CD37CE0.exe 1732 3D63B777F65056B236BA51180CD37CE0.exe 1732 3D63B777F65056B236BA51180CD37CE0.exe 1032 RegSvcs.exe 1032 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1732 3D63B777F65056B236BA51180CD37CE0.exe Token: SeDebugPrivilege 1032 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31 PID 1732 wrote to memory of 1032 1732 3D63B777F65056B236BA51180CD37CE0.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3D63B777F65056B236BA51180CD37CE0.exe"C:\Users\Admin\AppData\Local\Temp\3D63B777F65056B236BA51180CD37CE0.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD55a11d4c52a76804780cbb414b2595bdb
SHA114c89a2283c41b10ce8f1576404e1541c04a8125
SHA256e1b3260b2607c6a5fcf91575d1de278deceaf4e5f9f0530a3782c6d9567749d8
SHA5120bffe811cbba5278d39e20b66a5c4770e3855d1f5cbd45161e8ad304b78da73f555a3c42a198378efab3dfc81f384fdaefc6cbb893a708c7e2649a89fdd11762