Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 18:11
Static task
static1
Behavioral task
behavioral1
Sample
8ae5c67ba12d7028d34831679c57f372.exe
Resource
win7-20241023-en
General
-
Target
8ae5c67ba12d7028d34831679c57f372.exe
-
Size
666KB
-
MD5
8ae5c67ba12d7028d34831679c57f372
-
SHA1
76d36117d58b5c801c2d698eddc414b0a06bed05
-
SHA256
31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97
-
SHA512
7d18bfa40ddd24df9e656861f3f7854d7f8baa12b8c354665f07dc88e535e9a12e23a9e9aaed5ed093d51effc8aaff899a4a18053f6ae3efb3e6f3afa5ce42f0
-
SSDEEP
12288:GTBtWYMV+I4MVKW84KMmxGSeR6NKPpdCVsYJabrUKcQO++Zzo+JdNS2tJHB:wLGRgl4KMnSGzYJpKch++Ro+k2tJHB
Malware Config
Extracted
redline
cheat
185.222.57.77:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2720-29-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2720-26-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2720-24-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2720-33-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2720-31-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2720-29-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2720-26-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2720-24-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2720-33-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2720-31-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Sectoprat family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2860 powershell.exe 2940 powershell.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1720 set thread context of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ae5c67ba12d7028d34831679c57f372.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ae5c67ba12d7028d34831679c57f372.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1720 8ae5c67ba12d7028d34831679c57f372.exe 1720 8ae5c67ba12d7028d34831679c57f372.exe 1720 8ae5c67ba12d7028d34831679c57f372.exe 1720 8ae5c67ba12d7028d34831679c57f372.exe 2940 powershell.exe 2860 powershell.exe 2720 8ae5c67ba12d7028d34831679c57f372.exe 2720 8ae5c67ba12d7028d34831679c57f372.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1720 8ae5c67ba12d7028d34831679c57f372.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2720 8ae5c67ba12d7028d34831679c57f372.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2940 1720 8ae5c67ba12d7028d34831679c57f372.exe 31 PID 1720 wrote to memory of 2940 1720 8ae5c67ba12d7028d34831679c57f372.exe 31 PID 1720 wrote to memory of 2940 1720 8ae5c67ba12d7028d34831679c57f372.exe 31 PID 1720 wrote to memory of 2940 1720 8ae5c67ba12d7028d34831679c57f372.exe 31 PID 1720 wrote to memory of 2860 1720 8ae5c67ba12d7028d34831679c57f372.exe 33 PID 1720 wrote to memory of 2860 1720 8ae5c67ba12d7028d34831679c57f372.exe 33 PID 1720 wrote to memory of 2860 1720 8ae5c67ba12d7028d34831679c57f372.exe 33 PID 1720 wrote to memory of 2860 1720 8ae5c67ba12d7028d34831679c57f372.exe 33 PID 1720 wrote to memory of 2844 1720 8ae5c67ba12d7028d34831679c57f372.exe 34 PID 1720 wrote to memory of 2844 1720 8ae5c67ba12d7028d34831679c57f372.exe 34 PID 1720 wrote to memory of 2844 1720 8ae5c67ba12d7028d34831679c57f372.exe 34 PID 1720 wrote to memory of 2844 1720 8ae5c67ba12d7028d34831679c57f372.exe 34 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37 PID 1720 wrote to memory of 2720 1720 8ae5c67ba12d7028d34831679c57f372.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EHeXBEH.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EHeXBEH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8E8.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD5444dfcb62fb09ad8de699a5d55d95b79
SHA1f1cef14842b4791879318c31aa79d38d01a7290e
SHA256c0a07d63b5dce56a498bdae1c6729182d736f2592151232d8df3ce7162f865a7
SHA5128dc97ff55ae760728afd046a2ec0fe7947ffc59ded6830f0f8aa2ec4cadb063843b3eefabef4e29dbf7986a5caffc003373ad4abee6fcc47f12e51223696999e
-
Filesize
1KB
MD5e0a4921e95817453bf026ec1e6efe8ca
SHA1db459eeb35bb376c419916db04c7699c3f93fdf5
SHA2562399f7e2596383b9e3f09fcd73cc6188c62858b1e07fdd53bc918014c3b56a8a
SHA5123a928a44e6e21cda91f89ace28af988255f811d72ae1801e04328681dfcbc9cc8059698a48828370896401be2bbcb4e33f33b944996abd75c099abe36a0330c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CTCUCYJU7IWPBC9G88V5.temp
Filesize7KB
MD5ea03e726c66113835cc86d4ed213a7b4
SHA141740f6cbb6ed80dc3b71639982d9bedfb838057
SHA25636d03cc345bae013d385cae9b1845b25e6ba79de07b3cf1aa9850b8ec3709ca6
SHA51262a4782f1ad58788ac73fc477ecebcb9d3b70106514d34c9ff077b68905f89f865a3598d4631a62a1970b264cd952ec98037f7e38407836467041755b5ffcb9b