Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 01:44
Behavioral task
behavioral1
Sample
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe
Resource
win7-20240221-en
General
-
Target
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe
-
Size
629KB
-
MD5
901a623dbccaa22525373cd36195ee14
-
SHA1
9adb6dddb68cd7e116da9392e7ee63a8fa394495
-
SHA256
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec
-
SHA512
eabeba0eb9ae7e39577a7e313e50807cee1b888f1c8ff0fa375e5de9451a66471c791c23ea4f4af85151f96b065d55e8c1320026d8503a048a3e5968f8effc1d
-
SSDEEP
12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcN6S5UesUInNnpo2R2:hBXu9HGaVHN6S5U5Rn/Y
Malware Config
Extracted
redline
wordfile
185.38.142.10:7474
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-12-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1980-14-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1980-16-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
SectopRAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-12-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1980-14-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat behavioral1/memory/1980-16-0x0000000000400000-0x000000000041E000-memory.dmp family_sectoprat -
Processes:
resource yara_rule behavioral1/memory/2932-0-0x0000000000AC0000-0x0000000000C27000-memory.dmp upx behavioral1/memory/2932-18-0x0000000000AC0000-0x0000000000C27000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/2932-18-0x0000000000AC0000-0x0000000000C27000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exedescription pid process target process PID 2932 set thread context of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 1980 RegSvcs.exe 1980 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exepid process 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1980 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exepid process 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exepid process 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exedescription pid process target process PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe PID 2932 wrote to memory of 1980 2932 b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe"C:\Users\Admin\AppData\Local\Temp\b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\b5e250a95073b5dfe33f66c13cc89da0fc8d3af226e5efb06bb8fcfd9a4cd6ec.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD529f541459e21a85121560aeb053cd325
SHA1b98022d6436cd01591e3e62c1a8636b16db50f4f
SHA256d9ae258a45d4a4c08b820ad02e7e9264bbb79e51a26f9095c05ed0f78d3fec9d
SHA51244aa87101e30759980d1c516f4161ae68799e88a6f27b4e0807100c5b7b928c0c8c6dbf8dd80a4060384d9b0c59e0ee54904c40ace26c0f57a7c2cb86b53aa7c
-
C:\Users\Admin\AppData\Local\Temp\Cab349A.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar359A.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Local\Temp\tmp3BB9.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmp3BCF.tmpFilesize
92KB
MD5bbe71b58e84c50336ee2d3bad3609c39
SHA1bdd3227b48977e583127425cbc2f86ff4077ba10
SHA256b25b7e57924b2382d3178696782b51fa62b68fa7e763081d7a53471cccc1ff3c
SHA51207fcac6778f114fb372dac7ed489624b8e0aed347bc14af77ec36b5201df8b3d99e2a69a384756606030bb146f5c0780f39a274dc5a4b4f6863746ec7fa2ca2a
-
memory/1980-14-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1980-20-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/1980-19-0x000000007470E000-0x000000007470F000-memory.dmpFilesize
4KB
-
memory/1980-16-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1980-12-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1980-165-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2932-18-0x0000000000AC0000-0x0000000000C27000-memory.dmpFilesize
1.4MB
-
memory/2932-0-0x0000000000AC0000-0x0000000000C27000-memory.dmpFilesize
1.4MB
-
memory/2932-11-0x0000000000120000-0x0000000000124000-memory.dmpFilesize
16KB