Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 21:46
Static task
static1
Behavioral task
behavioral1
Sample
15f948da0e0786ee883bc9714ee6b47a.exe
Resource
win7-20240611-en
General
-
Target
15f948da0e0786ee883bc9714ee6b47a.exe
-
Size
809KB
-
MD5
15f948da0e0786ee883bc9714ee6b47a
-
SHA1
13d0747a12ce2783ac3a1d225d760cd5b2ed1aa1
-
SHA256
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573
-
SHA512
006913022a08797087c1a47e89f1fba3beef5eb7f925631d507e841f361b56fe7dbefa1a1a60c0f5542742ad71c0b142ab5f4d280bfd9bc50bf5f7018c6bb31e
-
SSDEEP
24576:aJr8tE+sQJRRGM3sU+7sdCGNcArcotgiko7ehxaFpmx9:aJ4LP1MsdV5c+g5OiaFM/
Malware Config
Extracted
redline
cheat
45.137.22.68:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2524-55-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2524-55-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2016 powershell.exe 2468 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO.exe15f948da0e0786ee883bc9714ee6b47a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation PO.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 15f948da0e0786ee883bc9714ee6b47a.exe -
Executes dropped EXE 2 IoCs
Processes:
PO.exePO.exepid process 32 PO.exe 2524 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 32 set thread context of 2524 32 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
PO.exepowershell.exepowershell.exepid process 32 PO.exe 32 PO.exe 32 PO.exe 2016 powershell.exe 2468 powershell.exe 32 PO.exe 2016 powershell.exe 2468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 32 PO.exe Token: SeDebugPrivilege 2016 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 2524 PO.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
15f948da0e0786ee883bc9714ee6b47a.exePO.exedescription pid process target process PID 1180 wrote to memory of 32 1180 15f948da0e0786ee883bc9714ee6b47a.exe PO.exe PID 1180 wrote to memory of 32 1180 15f948da0e0786ee883bc9714ee6b47a.exe PO.exe PID 1180 wrote to memory of 32 1180 15f948da0e0786ee883bc9714ee6b47a.exe PO.exe PID 32 wrote to memory of 2016 32 PO.exe powershell.exe PID 32 wrote to memory of 2016 32 PO.exe powershell.exe PID 32 wrote to memory of 2016 32 PO.exe powershell.exe PID 32 wrote to memory of 2468 32 PO.exe powershell.exe PID 32 wrote to memory of 2468 32 PO.exe powershell.exe PID 32 wrote to memory of 2468 32 PO.exe powershell.exe PID 32 wrote to memory of 1440 32 PO.exe schtasks.exe PID 32 wrote to memory of 1440 32 PO.exe schtasks.exe PID 32 wrote to memory of 1440 32 PO.exe schtasks.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe PID 32 wrote to memory of 2524 32 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15f948da0e0786ee883bc9714ee6b47a.exe"C:\Users\Admin\AppData\Local\Temp\15f948da0e0786ee883bc9714ee6b47a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EE0.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD5b7b9acb869ccc7f7ecb5304ec0384dee
SHA16a90751c95817903ee833d59a0abbef425a613b3
SHA2568cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA5127bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5278105c0acd1b8092f769a79d1d1bf5a
SHA19fddbfb715926a54c50b02438344d3e366ba7137
SHA25682ccf74744ef56e05f668cb753a206c941c6477543963b35eb7d4bf034429522
SHA5127d2b46607e29949f5dcb7438172226a0142c1b4ebc148adfc762a70aae0f483dd7e110af801e41d9f03c4a2cc39ce7fc22b8b612c8647ed423ebf31220345635
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
716KB
MD56da58e4a005e57e0eee2faf662dfd4ae
SHA12146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nicttia3.jmw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9EE0.tmpFilesize
1KB
MD5eead3c57c27942ccac4d8789dd6e1bef
SHA1a6d53a48f6c07abf86936797d40fa9956a686289
SHA25620030be8b9b3c1a1e552126e2824889838eac8b5f88314419329f928a5cc6c97
SHA51255daef3cc9f1599731bafd22834192fbd252515c07491a154755fdc0889f7f658ba898c4685747a0526984d1de83f679fa37a03b5346b74690d6c5840a4160e2
-
memory/32-59-0x0000000072DF0000-0x00000000735A0000-memory.dmpFilesize
7.7MB
-
memory/32-17-0x00000000053B0000-0x0000000005442000-memory.dmpFilesize
584KB
-
memory/32-22-0x0000000006E50000-0x0000000006E5E000-memory.dmpFilesize
56KB
-
memory/32-23-0x0000000006E60000-0x0000000006E70000-memory.dmpFilesize
64KB
-
memory/32-24-0x0000000006E90000-0x0000000006EF0000-memory.dmpFilesize
384KB
-
memory/32-25-0x0000000009560000-0x00000000095FC000-memory.dmpFilesize
624KB
-
memory/32-20-0x0000000005510000-0x000000000551A000-memory.dmpFilesize
40KB
-
memory/32-14-0x0000000072DFE000-0x0000000072DFF000-memory.dmpFilesize
4KB
-
memory/32-15-0x00000000008D0000-0x0000000000984000-memory.dmpFilesize
720KB
-
memory/32-21-0x0000000005B00000-0x0000000005B16000-memory.dmpFilesize
88KB
-
memory/32-16-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/32-19-0x0000000072DF0000-0x00000000735A0000-memory.dmpFilesize
7.7MB
-
memory/32-18-0x00000000056B0000-0x0000000005A04000-memory.dmpFilesize
3.3MB
-
memory/2016-90-0x00000000078F0000-0x000000000790A000-memory.dmpFilesize
104KB
-
memory/2016-77-0x0000000007780000-0x000000000779E000-memory.dmpFilesize
120KB
-
memory/2016-35-0x0000000005F60000-0x0000000005FC6000-memory.dmpFilesize
408KB
-
memory/2016-34-0x0000000005EF0000-0x0000000005F56000-memory.dmpFilesize
408KB
-
memory/2016-31-0x0000000002CA0000-0x0000000002CD6000-memory.dmpFilesize
216KB
-
memory/2016-32-0x0000000005750000-0x0000000005D78000-memory.dmpFilesize
6.2MB
-
memory/2016-97-0x0000000007C10000-0x0000000007C18000-memory.dmpFilesize
32KB
-
memory/2016-64-0x0000000006600000-0x000000000664C000-memory.dmpFilesize
304KB
-
memory/2016-63-0x00000000065D0000-0x00000000065EE000-memory.dmpFilesize
120KB
-
memory/2016-96-0x0000000007C30000-0x0000000007C4A000-memory.dmpFilesize
104KB
-
memory/2016-66-0x0000000006B90000-0x0000000006BC2000-memory.dmpFilesize
200KB
-
memory/2016-67-0x0000000070190000-0x00000000701DC000-memory.dmpFilesize
304KB
-
memory/2016-95-0x0000000007B30000-0x0000000007B44000-memory.dmpFilesize
80KB
-
memory/2016-94-0x0000000007B20000-0x0000000007B2E000-memory.dmpFilesize
56KB
-
memory/2016-88-0x00000000077E0000-0x0000000007883000-memory.dmpFilesize
652KB
-
memory/2016-33-0x00000000056F0000-0x0000000005712000-memory.dmpFilesize
136KB
-
memory/2016-89-0x0000000007F30000-0x00000000085AA000-memory.dmpFilesize
6.5MB
-
memory/2016-93-0x0000000007AF0000-0x0000000007B01000-memory.dmpFilesize
68KB
-
memory/2016-92-0x0000000007B70000-0x0000000007C06000-memory.dmpFilesize
600KB
-
memory/2468-91-0x0000000007C70000-0x0000000007C7A000-memory.dmpFilesize
40KB
-
memory/2468-78-0x0000000070190000-0x00000000701DC000-memory.dmpFilesize
304KB
-
memory/2524-55-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2524-65-0x0000000005280000-0x000000000538A000-memory.dmpFilesize
1.0MB
-
memory/2524-62-0x0000000005000000-0x000000000503C000-memory.dmpFilesize
240KB
-
memory/2524-61-0x00000000029F0000-0x0000000002A02000-memory.dmpFilesize
72KB
-
memory/2524-60-0x00000000055A0000-0x0000000005BB8000-memory.dmpFilesize
6.1MB