Analysis
-
max time kernel
104s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
02/04/2025, 04:16
General
-
Target
2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe
-
Size
679KB
-
MD5
63b60ae67da8b10796b0c91d2f9a2de2
-
SHA1
9e15f3db157bc8c57dfd4442ffbcb57b17a8ffef
-
SHA256
b5e4582459f04b0cad1536690f96bdb740d487788bc831f18fc8eecf14261e92
-
SHA512
ecba888bd0dd4bf53a93a0db5d8173a18a8c1e1b8b4d2de36faf2ed578e9781b6f94336bc705c6d3435cb5470c12c4abfa0f03df4d8679a7f73e94d52cef0a25
-
SSDEEP
12288:QvtMlZdojk17xdpckAsxK4RJV/JIigbyHPlAxfdAA:st34nbckw4p/JIigbuaxFA
Malware Config
Extracted
redline
cheat
23.105.161.229:21522
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
Sectoprat family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-02_63b60ae67da8b10796b0c91d2f9a2de2_agent-tesla_formbook_hiddentear_xloader.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
40KB
MD5dfd4f60adc85fc874327517efed62ff7
SHA1f97489afb75bfd5ee52892f37383fbc85aa14a69
SHA256c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
SHA512d76f75b1b5b23aa4f87c53ce44c3d3b7e41a44401e53d89f05a114600ea3dcd8beda9ca1977b489ac6ea5586cf26e47396e92d4796c370e89fab0aa76f38f3c4
-
Filesize
130KB
MD5358765abdd4ec17d2d4b80a601bd8a4c
SHA14ac249212656dc8d7702dec884793023fd5b01f9
SHA25697e64c2a849b7a242d399ccf60fb6437e12be6df779f74edbea8f31dcf209aa7
SHA512228d134486f53df9fc8e995bda55ec3b13a4adccf3918408c14ede4b34e9690f1127b0bc7fcc0c6228658b61b3093482e7205df04586a28bc1addc62716c8f9a
-
Filesize
56KB
MD51c832d859b03f2e59817374006fe1189
SHA1a4994a54e9f46a6c86ff92280c6dabe2bcd4cc42
SHA256bb923abf471bb79086ff9ace293602e1ad882d9af7946dda17ff1c3a7e19f45b
SHA512c4d3be414fa5dd30151cde9f6d808d56c26b031ff3f6446d21a15d071053787b6ba337b12909a56af7bb420f858dba5213f08e64ca9f836f52c98a18762b4bef
-
Filesize
228KB
MD5ee463e048e56b687d02521cd12788e2c
SHA1ee26598f8e8643df84711960e66a20ecbc6321b8
SHA2563a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8
SHA51242b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f
-
Filesize
96KB
MD56066c07e98c96795ecd876aa92fe10f8
SHA1f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA25633a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
SHA5127d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
6.2MB
-
Filesize
68KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
652KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
408KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
392KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
704KB