Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 16:23
Behavioral task
behavioral1
Sample
901a623dbccaa22525373cd36195ee14.exe
Resource
win7-20240220-en
General
-
Target
901a623dbccaa22525373cd36195ee14.exe
-
Size
629KB
-
MD5
901a623dbccaa22525373cd36195ee14
-
SHA1
9adb6dddb68cd7e116da9392e7ee63a8fa394495
-
SHA256
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec
-
SHA512
eabeba0eb9ae7e39577a7e313e50807cee1b888f1c8ff0fa375e5de9451a66471c791c23ea4f4af85151f96b065d55e8c1320026d8503a048a3e5968f8effc1d
-
SSDEEP
12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcN6S5UesUInNnpo2R2:hBXu9HGaVHN6S5U5Rn/Y
Malware Config
Extracted
redline
wordfile
185.38.142.10:7474
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-12-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2540-14-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2540-16-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-12-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2540-14-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2540-16-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Processes:
resource yara_rule behavioral1/memory/2092-0-0x0000000000F50000-0x00000000010B7000-memory.dmp upx behavioral1/memory/2092-18-0x0000000000F50000-0x00000000010B7000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2092-18-0x0000000000F50000-0x00000000010B7000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
901a623dbccaa22525373cd36195ee14.exedescription pid process target process PID 2092 set thread context of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2540 RegSvcs.exe 2540 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
901a623dbccaa22525373cd36195ee14.exepid process 2092 901a623dbccaa22525373cd36195ee14.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2540 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
901a623dbccaa22525373cd36195ee14.exepid process 2092 901a623dbccaa22525373cd36195ee14.exe 2092 901a623dbccaa22525373cd36195ee14.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
901a623dbccaa22525373cd36195ee14.exepid process 2092 901a623dbccaa22525373cd36195ee14.exe 2092 901a623dbccaa22525373cd36195ee14.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
901a623dbccaa22525373cd36195ee14.exedescription pid process target process PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe PID 2092 wrote to memory of 2540 2092 901a623dbccaa22525373cd36195ee14.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\901a623dbccaa22525373cd36195ee14.exe"C:\Users\Admin\AppData\Local\Temp\901a623dbccaa22525373cd36195ee14.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\901a623dbccaa22525373cd36195ee14.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Cab3803.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar38E5.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\Temp\tmp3A74.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp3A89.tmpFilesize
92KB
MD518e04095708297d6889a6962f81e8d8f
SHA19a25645db1da0217092c06579599b04982192124
SHA2564ed16c019fe50bb4ab1c9dcedf0e52f93454b5dbaf18615d60761e7927b69fb7
SHA51245ec57bddeeb8bca05babcf8da83bf9db630819b23076a1cf79f2e54b3e88e14cd7db650332554026ab5e8634061dd699f322bcba6683765063e67ac47ea1caf
-
memory/2092-11-0x0000000000120000-0x0000000000124000-memory.dmpFilesize
16KB
-
memory/2092-0-0x0000000000F50000-0x00000000010B7000-memory.dmpFilesize
1.4MB
-
memory/2092-18-0x0000000000F50000-0x00000000010B7000-memory.dmpFilesize
1.4MB
-
memory/2540-14-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2540-20-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/2540-19-0x00000000741BE000-0x00000000741BF000-memory.dmpFilesize
4KB
-
memory/2540-16-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2540-12-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2540-173-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB