Analysis
-
max time kernel
128s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 19:06
Static task
static1
Behavioral task
behavioral1
Sample
568967433c84d1fd3068fae82d24d750.exe
Resource
win7-20240508-en
General
-
Target
568967433c84d1fd3068fae82d24d750.exe
-
Size
504KB
-
MD5
568967433c84d1fd3068fae82d24d750
-
SHA1
030204e478cd66d7234850d9ef95f9b52a2dc476
-
SHA256
35bc174139612d416a683cb302b450d21b1eb2a8cc23d0fb22d0152b35d585c6
-
SHA512
13481aee6d2fdc5666f4febfa33a370c8590bb712be6f75bf7d212e4041f0c625b2068aad1f265254a62c4408c04070f911d378a5014061aaccf9f8c9114db75
-
SSDEEP
12288:VX0AXmuz7sdJoJmrTNj/RQI1UrYNw9KlRVjd1z+n/Xfu+XHTmyDLNkR:ZIXx/RQIq1olRVBcRXhD0
Malware Config
Extracted
redline
cheat
185.222.58.79:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4636-48-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4636-48-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2264 powershell.exe 4948 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
568967433c84d1fd3068fae82d24d750.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 568967433c84d1fd3068fae82d24d750.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
568967433c84d1fd3068fae82d24d750.exedescription pid process target process PID 4804 set thread context of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
568967433c84d1fd3068fae82d24d750.exepowershell.exepowershell.exepid process 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 2264 powershell.exe 4948 powershell.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 4804 568967433c84d1fd3068fae82d24d750.exe 2264 powershell.exe 4948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
568967433c84d1fd3068fae82d24d750.exepowershell.exepowershell.exe568967433c84d1fd3068fae82d24d750.exedescription pid process Token: SeDebugPrivilege 4804 568967433c84d1fd3068fae82d24d750.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeDebugPrivilege 4636 568967433c84d1fd3068fae82d24d750.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
568967433c84d1fd3068fae82d24d750.exedescription pid process target process PID 4804 wrote to memory of 2264 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 2264 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 2264 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 4948 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 4948 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 4948 4804 568967433c84d1fd3068fae82d24d750.exe powershell.exe PID 4804 wrote to memory of 2956 4804 568967433c84d1fd3068fae82d24d750.exe schtasks.exe PID 4804 wrote to memory of 2956 4804 568967433c84d1fd3068fae82d24d750.exe schtasks.exe PID 4804 wrote to memory of 2956 4804 568967433c84d1fd3068fae82d24d750.exe schtasks.exe PID 4804 wrote to memory of 2144 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 2144 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 2144 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 1376 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 1376 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 1376 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe PID 4804 wrote to memory of 4636 4804 568967433c84d1fd3068fae82d24d750.exe 568967433c84d1fd3068fae82d24d750.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rPXxwx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rPXxwx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9839.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"C:\Users\Admin\AppData\Local\Temp\568967433c84d1fd3068fae82d24d750.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\568967433c84d1fd3068fae82d24d750.exe.logFilesize
1KB
MD5f5a2e88ef90ba9b096ebb0446e34e765
SHA14796e314d3f6aa97bfd868e07d7de3879306e179
SHA256ca5755b5112b5d2bea6f139a3230fd97a65be1e1c404da7f79e09ceb97feb06d
SHA5128524ce7a3d35d2fb0dffeefb53d9ff1e64b35daa2ed398624d59f108e84bb558383857505520656b36962bed230daf3f14e941e6f3fbbb03ccf35bd29164b29d
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5e5c0ce6e0d7e545e428764d5c71c7175
SHA11e0bb0590e52aaa0e7a84969da6092d7f117128c
SHA256f057062049552f94358d7c54f7bfbc1b11d47b2f7508734a0350608bc4bda1a7
SHA51274cc846774bc1e135863a85d9d6c9150b26e7dfb1ed7399ea11b66a300ef2a918a6b22e770f33440dfc5ac21a85f35817cae7873b9986c78b7e5a2ef98c9f456
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_csq25j0k.gqk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp9839.tmpFilesize
1KB
MD5fa889240a1643f4b5f243b0011ff37ca
SHA11d1dfb6481a9e75f6d10c3602cbc3628aada926e
SHA256c43c0623e37296da69bc65b3b2f6678460ecfa7ace4665b934ba6bc806427713
SHA51214b2b3ea137866f5f2161d279dd420332bcb90c610daee42ca20bb13a5c27dbb7fba19e57abe559f0ad3bece3266eb416360ffa9531c3ca2714eb325523b44c1
-
memory/2264-59-0x0000000007270000-0x00000000072A2000-memory.dmpFilesize
200KB
-
memory/2264-24-0x0000000005A50000-0x0000000005AB6000-memory.dmpFilesize
408KB
-
memory/2264-87-0x0000000007610000-0x000000000761E000-memory.dmpFilesize
56KB
-
memory/2264-86-0x00000000075E0000-0x00000000075F1000-memory.dmpFilesize
68KB
-
memory/2264-85-0x0000000007660000-0x00000000076F6000-memory.dmpFilesize
600KB
-
memory/2264-74-0x0000000007450000-0x000000000745A000-memory.dmpFilesize
40KB
-
memory/2264-72-0x0000000007A20000-0x000000000809A000-memory.dmpFilesize
6.5MB
-
memory/2264-73-0x00000000073E0000-0x00000000073FA000-memory.dmpFilesize
104KB
-
memory/2264-17-0x0000000002790000-0x00000000027C6000-memory.dmpFilesize
216KB
-
memory/2264-54-0x00000000060B0000-0x00000000060CE000-memory.dmpFilesize
120KB
-
memory/2264-19-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2264-20-0x0000000005260000-0x0000000005888000-memory.dmpFilesize
6.2MB
-
memory/2264-21-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2264-88-0x0000000007620000-0x0000000007634000-memory.dmpFilesize
80KB
-
memory/2264-89-0x0000000007720000-0x000000000773A000-memory.dmpFilesize
104KB
-
memory/2264-23-0x00000000059E0000-0x0000000005A46000-memory.dmpFilesize
408KB
-
memory/2264-22-0x00000000058C0000-0x00000000058E2000-memory.dmpFilesize
136KB
-
memory/2264-90-0x0000000007700000-0x0000000007708000-memory.dmpFilesize
32KB
-
memory/2264-35-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2264-36-0x0000000005AC0000-0x0000000005E14000-memory.dmpFilesize
3.3MB
-
memory/2264-60-0x0000000075430000-0x000000007547C000-memory.dmpFilesize
304KB
-
memory/2264-71-0x00000000072B0000-0x0000000007353000-memory.dmpFilesize
652KB
-
memory/2264-96-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/2264-70-0x0000000006640000-0x000000000665E000-memory.dmpFilesize
120KB
-
memory/2264-57-0x0000000006670000-0x00000000066BC000-memory.dmpFilesize
304KB
-
memory/4636-48-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4636-58-0x0000000005510000-0x000000000561A000-memory.dmpFilesize
1.0MB
-
memory/4636-55-0x0000000005260000-0x000000000529C000-memory.dmpFilesize
240KB
-
memory/4636-53-0x0000000005200000-0x0000000005212000-memory.dmpFilesize
72KB
-
memory/4636-52-0x0000000005970000-0x0000000005F88000-memory.dmpFilesize
6.1MB
-
memory/4804-10-0x00000000078C0000-0x00000000078C8000-memory.dmpFilesize
32KB
-
memory/4804-6-0x0000000005CA0000-0x0000000005D3C000-memory.dmpFilesize
624KB
-
memory/4804-51-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4804-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmpFilesize
4KB
-
memory/4804-1-0x0000000000FA0000-0x0000000001020000-memory.dmpFilesize
512KB
-
memory/4804-18-0x0000000074B8E000-0x0000000074B8F000-memory.dmpFilesize
4KB
-
memory/4804-12-0x0000000007B40000-0x0000000007BA0000-memory.dmpFilesize
384KB
-
memory/4804-11-0x00000000078E0000-0x00000000078EC000-memory.dmpFilesize
48KB
-
memory/4804-2-0x0000000005FD0000-0x0000000006574000-memory.dmpFilesize
5.6MB
-
memory/4804-3-0x0000000005A20000-0x0000000005AB2000-memory.dmpFilesize
584KB
-
memory/4804-9-0x0000000005FC0000-0x0000000005FD2000-memory.dmpFilesize
72KB
-
memory/4804-8-0x0000000005F40000-0x0000000005FB6000-memory.dmpFilesize
472KB
-
memory/4804-7-0x0000000006AB0000-0x0000000006FDC000-memory.dmpFilesize
5.2MB
-
memory/4804-4-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4804-5-0x0000000005BB0000-0x0000000005BBA000-memory.dmpFilesize
40KB
-
memory/4948-56-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4948-75-0x0000000075430000-0x000000007547C000-memory.dmpFilesize
304KB
-
memory/4948-47-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4948-97-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB
-
memory/4948-37-0x0000000074B80000-0x0000000075330000-memory.dmpFilesize
7.7MB