Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 06:01
General
- Target file.exe
- Size 33.9MB
- Sample260714-graqpsht4x
- SHA256 7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a
Malware Config
Extracted
-
redline
-
kilo3click
-
94.154.32.144:1912
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Detects DonutLoader 2 IoCs
- RedLine payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonI -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ExclusionProcess 'powershell.exe' -ExclusionProcess 'dllhost.exe' -ExclusionProcess 'explorer.exe' 2>$null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qrx3ukd4.xgz.ps1
memory/2000-44-0x000002A65FFD0000-0x000002A660010000-memory.dmp
memory/2000-12-0x00000265C9170000-0x00000265C91A0000-memory.dmp
memory/2000-16-0x000002A65E1D0000-0x000002A65E220000-memory.dmp
memory/2000-28-0x000002A65FFB0000-0x000002A65FFD0000-memory.dmp
memory/2000-24-0x000002A65EF30000-0x000002A65EF80000-memory.dmp
memory/2000-20-0x000002A65E220000-0x000002A65E240000-memory.dmp
memory/2000-0-0x000002A65F0C0000-0x000002A65FD50000-memory.dmp
memory/2000-59-0x000002A662250000-0x000002A662260000-memory.dmp
memory/2000-58-0x000002A67C690000-0x000002A67CBB8000-memory.dmp
memory/2000-57-0x000002A662250000-0x000002A662260000-memory.dmp
memory/2000-8-0x000002A660230000-0x000002A660430000-memory.dmp
memory/2000-4-0x00000265C8FC0000-0x00000265C8FE0000-memory.dmp
memory/2000-52-0x000002A67B8B0000-0x000002A67B9BA000-memory.dmp
memory/2000-49-0x000002A662250000-0x000002A662260000-memory.dmp
memory/2000-51-0x000002A662250000-0x000002A662260000-memory.dmp
memory/2000-50-0x000002A6620F0000-0x000002A662142000-memory.dmp
memory/2000-48-0x000002A660430000-0x000002A660483000-memory.dmp
memory/2000-53-0x000002A6621D0000-0x000002A6621E2000-memory.dmp
memory/2000-54-0x000002A662260000-0x000002A66229C000-memory.dmp
memory/2000-55-0x000002A6622F0000-0x000002A662340000-memory.dmp
memory/2000-56-0x000002A67BF90000-0x000002A67C152000-memory.dmp
memory/2632-39-0x000001FC6DED0000-0x000001FC6DEF2000-memory.dmp
memory/2632-33-0x000001FC6B7A0000-0x000001FC6B7B0000-memory.dmp
memory/2632-32-0x000001FC6B7A0000-0x000001FC6B7B0000-memory.dmp