cf09c4bec1494405fa4c5c2a499cb8e17ac5bd8e31a65e0612c13c41ad8ab457

Resubmissions

05-01-2025 15:41

250105-s4qhgaykaw 3

04-01-2025 17:05

250104-vl4ngsyld1 10

04-01-2025 16:52

250104-vdkkmszpbm 10

04-01-2025 16:51

250104-vc55yszpak 1

Analysis

max time kernel
10s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

redz hub.lua
Size

110B
MD5

e64dc7639631f60e56ddf2ee462c73f3
SHA1

797012686a77f6b68860e26ab692fb5e5dd56190
SHA256

cf09c4bec1494405fa4c5c2a499cb8e17ac5bd8e31a65e0612c13c41ad8ab457
SHA512

b74992a1da0260565a52f5a7daf93a48199efdec57db36a8e08e1efb06aca815ef1cfac19928ec25127fa8390fce09996a407ed8dc5dd210ef49c9de942d6fdf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe
372	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 2976	372	OpenWith.exe	87
PID 372 wrote to memory of 2976	372	OpenWith.exe	87

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\redz hub.lua"
1⤵
- Modifies registry class
PID:4796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\redz hub.lua
  2⤵
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads