Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    11-01-2025 18:11

General

  • Target

    8ae5c67ba12d7028d34831679c57f372.exe

  • Size

    666KB

  • MD5

    8ae5c67ba12d7028d34831679c57f372

  • SHA1

    76d36117d58b5c801c2d698eddc414b0a06bed05

  • SHA256

    31a2ec31c4722d3011b75595c76e677aba7e5bc164c667d709943893ebea4f97

  • SHA512

    7d18bfa40ddd24df9e656861f3f7854d7f8baa12b8c354665f07dc88e535e9a12e23a9e9aaed5ed093d51effc8aaff899a4a18053f6ae3efb3e6f3afa5ce42f0

  • SSDEEP

    12288:GTBtWYMV+I4MVKW84KMmxGSeR6NKPpdCVsYJabrUKcQO++Zzo+JdNS2tJHB:wLGRgl4KMnSGzYJpKch++Ro+k2tJHB

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.222.57.77:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Sectoprat family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe
    "C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2940
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EHeXBEH.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2860
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EHeXBEH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE8E8.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2844
    • C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe
      "C:\Users\Admin\AppData\Local\Temp\8ae5c67ba12d7028d34831679c57f372.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp13B9.tmp

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\Users\Admin\AppData\Local\Temp\tmp13CE.tmp

    Filesize

    92KB

    MD5

    444dfcb62fb09ad8de699a5d55d95b79

    SHA1

    f1cef14842b4791879318c31aa79d38d01a7290e

    SHA256

    c0a07d63b5dce56a498bdae1c6729182d736f2592151232d8df3ce7162f865a7

    SHA512

    8dc97ff55ae760728afd046a2ec0fe7947ffc59ded6830f0f8aa2ec4cadb063843b3eefabef4e29dbf7986a5caffc003373ad4abee6fcc47f12e51223696999e

  • C:\Users\Admin\AppData\Local\Temp\tmpE8E8.tmp

    Filesize

    1KB

    MD5

    e0a4921e95817453bf026ec1e6efe8ca

    SHA1

    db459eeb35bb376c419916db04c7699c3f93fdf5

    SHA256

    2399f7e2596383b9e3f09fcd73cc6188c62858b1e07fdd53bc918014c3b56a8a

    SHA512

    3a928a44e6e21cda91f89ace28af988255f811d72ae1801e04328681dfcbc9cc8059698a48828370896401be2bbcb4e33f33b944996abd75c099abe36a0330c8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CTCUCYJU7IWPBC9G88V5.temp

    Filesize

    7KB

    MD5

    ea03e726c66113835cc86d4ed213a7b4

    SHA1

    41740f6cbb6ed80dc3b71639982d9bedfb838057

    SHA256

    36d03cc345bae013d385cae9b1845b25e6ba79de07b3cf1aa9850b8ec3709ca6

    SHA512

    62a4782f1ad58788ac73fc477ecebcb9d3b70106514d34c9ff077b68905f89f865a3598d4631a62a1970b264cd952ec98037f7e38407836467041755b5ffcb9b

  • memory/1720-3-0x00000000004B0000-0x00000000004CC000-memory.dmp

    Filesize

    112KB

  • memory/1720-5-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1720-6-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1720-7-0x0000000004DC0000-0x0000000004E22000-memory.dmp

    Filesize

    392KB

  • memory/1720-4-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/1720-30-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1720-0-0x000000007499E000-0x000000007499F000-memory.dmp

    Filesize

    4KB

  • memory/1720-2-0x0000000074990000-0x000000007507E000-memory.dmp

    Filesize

    6.9MB

  • memory/1720-1-0x0000000000980000-0x0000000000A2E000-memory.dmp

    Filesize

    696KB

  • memory/2720-22-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-24-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-20-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-26-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-33-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-31-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2720-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2720-29-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB