Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
Resource
win7-20240508-en
General
-
Target
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
-
Size
558KB
-
MD5
a56b296b440dd37fdc820a79373ab0d9
-
SHA1
cc555a9ece05af0a60ebb89e5c392c6dbbedac4a
-
SHA256
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a
-
SHA512
a3a6ef1824d75eacd0342a6d21b0f80bb247ccbbedebdba5e26d1cb04e5ef41be85f758957a5f704cae160e946c2757e0531b1466b0409ccc2c09bd5c2b53186
-
SSDEEP
12288:cvVX9Koe0T8l++GpoTp2AnNtYyTlOr3++yDuzK4Y/3vw:at7e0T8l+xpoTp2ANtzlOr3+B+4/3
Malware Config
Extracted
redline
cheat
45.137.22.71:55615
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-21-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2492-24-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2492-19-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2492-26-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/2492-25-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-21-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2492-24-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2492-19-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2492-26-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/2492-25-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exedescription pid process target process PID 2432 set thread context of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exepowershell.exepid process 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 2336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exepowershell.exe3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exedescription pid process Token: SeDebugPrivilege 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe Token: SeDebugPrivilege 2336 powershell.exe Token: SeDebugPrivilege 2492 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exedescription pid process target process PID 2432 wrote to memory of 2336 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe powershell.exe PID 2432 wrote to memory of 2336 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe powershell.exe PID 2432 wrote to memory of 2336 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe powershell.exe PID 2432 wrote to memory of 2336 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe powershell.exe PID 2432 wrote to memory of 2484 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe schtasks.exe PID 2432 wrote to memory of 2484 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe schtasks.exe PID 2432 wrote to memory of 2484 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe schtasks.exe PID 2432 wrote to memory of 2484 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe schtasks.exe PID 2432 wrote to memory of 2472 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2472 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2472 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2472 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe PID 2432 wrote to memory of 2492 2432 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe 3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XGWXzz.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XGWXzz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFD6.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"C:\Users\Admin\AppData\Local\Temp\3abd9925a66cbc91c5bb9b261fe18db081581fd898b1197122c20aabf055474a.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBFD6.tmpFilesize
1KB
MD5b63a0fe89521aaadfafd67af4eeb8eb6
SHA17055de01a27af411dedc8c283aa2c97751994527
SHA25662a914e812f589288c5b3404fee09aaa381030a8d5bda7c1829753a8d229ecfa
SHA5123dca82127129a0c39fc10a1d6e547a177bfdbae4c6a2feb30626f2d97cdb0174fc3ca2a7450e66b6cff3da3da8b32944a685ac3a9f92bf6e446b41ff68c7194c
-
memory/2432-4-0x00000000742AE000-0x00000000742AF000-memory.dmpFilesize
4KB
-
memory/2432-5-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2432-27-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2432-0-0x00000000742AE000-0x00000000742AF000-memory.dmpFilesize
4KB
-
memory/2432-1-0x0000000000330000-0x00000000003C0000-memory.dmpFilesize
576KB
-
memory/2432-6-0x0000000000480000-0x0000000000490000-memory.dmpFilesize
64KB
-
memory/2432-7-0x0000000004970000-0x00000000049C8000-memory.dmpFilesize
352KB
-
memory/2432-2-0x00000000742A0000-0x000000007498E000-memory.dmpFilesize
6.9MB
-
memory/2432-3-0x00000000004A0000-0x00000000004BC000-memory.dmpFilesize
112KB
-
memory/2492-24-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-21-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2492-19-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-17-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-26-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-25-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2492-15-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB