Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe
Resource
win7-20240221-en
General
-
Target
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe
-
Size
809KB
-
MD5
15f948da0e0786ee883bc9714ee6b47a
-
SHA1
13d0747a12ce2783ac3a1d225d760cd5b2ed1aa1
-
SHA256
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573
-
SHA512
006913022a08797087c1a47e89f1fba3beef5eb7f925631d507e841f361b56fe7dbefa1a1a60c0f5542742ad71c0b142ab5f4d280bfd9bc50bf5f7018c6bb31e
-
SSDEEP
24576:aJr8tE+sQJRRGM3sU+7sdCGNcArcotgiko7ehxaFpmx9:aJ4LP1MsdV5c+g5OiaFM/
Malware Config
Extracted
redline
cheat
45.137.22.68:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-34-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-34-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-34-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1216 powershell.exe 2132 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exePO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation PO.exe -
Executes dropped EXE 2 IoCs
Processes:
PO.exePO.exepid process 3828 PO.exe 3144 PO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO.exedescription pid process target process PID 3828 set thread context of 3144 3828 PO.exe PO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
PO.exepowershell.exepowershell.exepid process 3828 PO.exe 3828 PO.exe 3828 PO.exe 2132 powershell.exe 3828 PO.exe 1216 powershell.exe 1216 powershell.exe 2132 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO.exepowershell.exepowershell.exePO.exedescription pid process Token: SeDebugPrivilege 3828 PO.exe Token: SeDebugPrivilege 1216 powershell.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeDebugPrivilege 3144 PO.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exePO.exedescription pid process target process PID 4472 wrote to memory of 3828 4472 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 4472 wrote to memory of 3828 4472 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 4472 wrote to memory of 3828 4472 88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe PO.exe PID 3828 wrote to memory of 1216 3828 PO.exe powershell.exe PID 3828 wrote to memory of 1216 3828 PO.exe powershell.exe PID 3828 wrote to memory of 1216 3828 PO.exe powershell.exe PID 3828 wrote to memory of 2132 3828 PO.exe powershell.exe PID 3828 wrote to memory of 2132 3828 PO.exe powershell.exe PID 3828 wrote to memory of 2132 3828 PO.exe powershell.exe PID 3828 wrote to memory of 1336 3828 PO.exe schtasks.exe PID 3828 wrote to memory of 1336 3828 PO.exe schtasks.exe PID 3828 wrote to memory of 1336 3828 PO.exe schtasks.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe PID 3828 wrote to memory of 3144 3828 PO.exe PO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"C:\Users\Admin\AppData\Local\Temp\88b889a1477c81510c62a46c9eb1d77d386c59dceb0523e8b5734b6dde252573.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gsGRKUB.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gsGRKUB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp98C5.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO.exe.logFilesize
1KB
MD5b7b9acb869ccc7f7ecb5304ec0384dee
SHA16a90751c95817903ee833d59a0abbef425a613b3
SHA2568cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA5127bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ae38057fc596cbc6ef8233245789ece9
SHA1b7df54cf4f2ac16600f375764daa6b0206942de8
SHA2564780760b923a324dbf22cd302fc25e24f56f2c7220906e447c09274b7ad2a518
SHA5123eaee436656f091c21a93c7e39cb8b7fbb34d7d59310f2913bbf65fd79f6282e205906076a5de03ca21a3b80fbac1133942f991701bf8c4ac5cb85fea361b2e0
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.exeFilesize
716KB
MD56da58e4a005e57e0eee2faf662dfd4ae
SHA12146c9d021ac262c918c4cdf5d5c842568ee2c87
SHA256364a57fff4c2f5d8f2b35945016f4660ea9e583250e81c13d3da523d21cf33cf
SHA512f0895ce9160e05c434f3b3bb5ab6907dd4a767b38ea19f276de446e1d62476b00b912f4fb432bb12a4cadf19e25310b5c7a716b6d51a0156a47bc6c31a10ceeb
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PO.jpgFilesize
48KB
MD5e83ccb51ee74efd2a221be293d23c69a
SHA14365ca564f7cdd7337cf0f83ac5fd64317fb4c32
SHA256da931852a19a707d01c3edf138622b8601056c42525f8ac40cb48af43a7410cc
SHA5120252e629fbdafdb66ff63ef76d18f25d1ca46ac3eff019f012361db45ebd34d1a7a9ad35f7a2fc5830676c771997633f3abf1dc3224bd8f6bd55456b0a554a46
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ddkaf0x.vlf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp98C5.tmpFilesize
1KB
MD508478d0743614798f89c7a348a80e838
SHA139dc732c3b6bfec2753641f82cfe883b8e96700a
SHA256ce90e08f381ece66200157404c59e80070903c1596df44fe880f12e0c7c5289e
SHA512fa8688e831ae9ae44e9704f9fbf6b47e01cf94cbe0fb286db1868909399f0e7673fb900c067184f2a21e7eb1d439e9a257e8472d0493ca41f86bf8fdd3b3eb48
-
memory/1216-90-0x0000000007C70000-0x0000000007C8A000-memory.dmpFilesize
104KB
-
memory/1216-31-0x0000000003030000-0x0000000003066000-memory.dmpFilesize
216KB
-
memory/1216-91-0x0000000007CF0000-0x0000000007CFA000-memory.dmpFilesize
40KB
-
memory/1216-93-0x0000000007E70000-0x0000000007E81000-memory.dmpFilesize
68KB
-
memory/1216-89-0x00000000082C0000-0x000000000893A000-memory.dmpFilesize
6.5MB
-
memory/1216-64-0x0000000006950000-0x000000000696E000-memory.dmpFilesize
120KB
-
memory/1216-94-0x0000000007EA0000-0x0000000007EAE000-memory.dmpFilesize
56KB
-
memory/1216-66-0x0000000006F10000-0x0000000006F42000-memory.dmpFilesize
200KB
-
memory/1216-32-0x0000000005B00000-0x0000000006128000-memory.dmpFilesize
6.2MB
-
memory/1216-95-0x0000000007EB0000-0x0000000007EC4000-memory.dmpFilesize
80KB
-
memory/1216-78-0x0000000007B20000-0x0000000007BC3000-memory.dmpFilesize
652KB
-
memory/1216-96-0x0000000007FB0000-0x0000000007FCA000-memory.dmpFilesize
104KB
-
memory/1216-67-0x000000006F690000-0x000000006F6DC000-memory.dmpFilesize
304KB
-
memory/1216-77-0x0000000006EF0000-0x0000000006F0E000-memory.dmpFilesize
120KB
-
memory/2132-79-0x000000006F690000-0x000000006F6DC000-memory.dmpFilesize
304KB
-
memory/2132-36-0x0000000004B40000-0x0000000004B62000-memory.dmpFilesize
136KB
-
memory/2132-37-0x00000000053C0000-0x0000000005426000-memory.dmpFilesize
408KB
-
memory/2132-38-0x00000000054E0000-0x0000000005546000-memory.dmpFilesize
408KB
-
memory/2132-92-0x0000000007090000-0x0000000007126000-memory.dmpFilesize
600KB
-
memory/2132-97-0x0000000007130000-0x0000000007138000-memory.dmpFilesize
32KB
-
memory/3144-60-0x0000000005AB0000-0x00000000060C8000-memory.dmpFilesize
6.1MB
-
memory/3144-63-0x0000000005550000-0x000000000559C000-memory.dmpFilesize
304KB
-
memory/3144-65-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/3144-62-0x0000000005510000-0x000000000554C000-memory.dmpFilesize
240KB
-
memory/3144-61-0x00000000054B0000-0x00000000054C2000-memory.dmpFilesize
72KB
-
memory/3144-104-0x0000000007180000-0x00000000076AC000-memory.dmpFilesize
5.2MB
-
memory/3144-34-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3144-103-0x0000000006A80000-0x0000000006C42000-memory.dmpFilesize
1.8MB
-
memory/3828-21-0x0000000005990000-0x00000000059A6000-memory.dmpFilesize
88KB
-
memory/3828-23-0x00000000066B0000-0x00000000066C0000-memory.dmpFilesize
64KB
-
memory/3828-22-0x00000000066A0000-0x00000000066AE000-memory.dmpFilesize
56KB
-
memory/3828-24-0x00000000066E0000-0x0000000006740000-memory.dmpFilesize
384KB
-
memory/3828-20-0x00000000051D0000-0x00000000051DA000-memory.dmpFilesize
40KB
-
memory/3828-19-0x0000000072CA0000-0x0000000073450000-memory.dmpFilesize
7.7MB
-
memory/3828-18-0x0000000004D10000-0x0000000005064000-memory.dmpFilesize
3.3MB
-
memory/3828-17-0x0000000004C70000-0x0000000004D02000-memory.dmpFilesize
584KB
-
memory/3828-16-0x0000000005220000-0x00000000057C4000-memory.dmpFilesize
5.6MB
-
memory/3828-15-0x0000000000160000-0x0000000000214000-memory.dmpFilesize
720KB
-
memory/3828-14-0x0000000072CAE000-0x0000000072CAF000-memory.dmpFilesize
4KB
-
memory/3828-25-0x0000000008DD0000-0x0000000008E6C000-memory.dmpFilesize
624KB
-
memory/3828-40-0x0000000072CA0000-0x0000000073450000-memory.dmpFilesize
7.7MB