redline | 80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe
Size

839KB
MD5

ebc4b354d6ec654829f9de447d0c7b04
SHA1

9e5d3ccae0d22bd27f8ae39b2f35b274dabd7fd1
SHA256

80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab
SHA512

1cb3487cf2f1864d22d3148b30ecf70794567af3a84c9ba5f2d16b5dac38017347c4efb92e4978ebfe57588c5883a2ebe4af33e83eaafad99de202548fd0048e
SSDEEP

24576:3CIQgVHOEqG7111cZRHVzutBSRhmG5ep:yAH1KL1zwBSRhmAI

Score

10^/10

redline sectoprat xworm x3.0 foundry execution infostealer rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

79.110.49.209:7000

Mutex

biVc5L0dNUTxuebk

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

redline

Botnet

X3.0 Foundry

79.110.49.209:37552

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

\Users\Admin\AppData\Roaming\X3 Foundry.exe family_xworm
behavioral1/memory/2588-24-0x0000000001310000-0x0000000001320000-memory.dmp family_xworm
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 2 IoCs

Processes:

resource yara_rule

\Users\Admin\AppData\Roaming\X3.exe family_redline
behavioral1/memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp family_redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat
SectopRAT payload 2 IoCs

Processes:

resource yara_rule

\Users\Admin\AppData\Roaming\X3.exe family_sectoprat
behavioral1/memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp family_sectoprat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

resource	yara_rule
\Users\Admin\AppData\Roaming\X3 Foundry.exe	family_xworm
behavioral1/memory/2588-24-0x0000000001310000-0x0000000001320000-memory.dmp	family_xworm

resource	yara_rule
\Users\Admin\AppData\Roaming\X3.exe	family_redline
behavioral1/memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp	family_redline

resource	yara_rule
\Users\Admin\AppData\Roaming\X3.exe	family_sectoprat
behavioral1/memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp	family_sectoprat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\X3.exe	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\X3 Foundry.exe	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2588-24-0x0000000001310000-0x0000000001320000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

976 powershell.exe
1636 powershell.exe
2228 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

X3 Libraries.exeX3 Foundry.exeX3.exe

pid process

2220 X3 Libraries.exe
2588 X3 Foundry.exe
2684 X3.exe

pid	process
976	powershell.exe
1636	powershell.exe
2228	powershell.exe

pid	process
2220	X3 Libraries.exe
2588	X3 Foundry.exe
2684	X3.exe

Loads dropped DLL 3 IoCs

Processes:

80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe

pid	process
2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe
2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe
2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

X3 Foundry.exe

pid process

2588 X3 Foundry.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2228 powershell.exe
1636 powershell.exe
976 powershell.exe

flow	ioc
5	ip-api.com

pid	process
2588	X3 Foundry.exe

pid	process
2228	powershell.exe
1636	powershell.exe
976	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exeX3.exeX3 Foundry.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	2684	X3.exe
Token: SeDebugPrivilege	2588	X3 Foundry.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exeX3 Foundry.exe

description	pid	process	target process
PID 2180 wrote to memory of 2228	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	powershell.exe
PID 2180 wrote to memory of 2228	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	powershell.exe
PID 2180 wrote to memory of 2228	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	powershell.exe
PID 2180 wrote to memory of 2228	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	powershell.exe
PID 2180 wrote to memory of 2220	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Libraries.exe
PID 2180 wrote to memory of 2220	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Libraries.exe
PID 2180 wrote to memory of 2220	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Libraries.exe
PID 2180 wrote to memory of 2220	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Libraries.exe
PID 2180 wrote to memory of 2588	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Foundry.exe
PID 2180 wrote to memory of 2588	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Foundry.exe
PID 2180 wrote to memory of 2588	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Foundry.exe
PID 2180 wrote to memory of 2588	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3 Foundry.exe
PID 2180 wrote to memory of 2684	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3.exe
PID 2180 wrote to memory of 2684	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3.exe
PID 2180 wrote to memory of 2684	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3.exe
PID 2180 wrote to memory of 2684	2180	80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe	X3.exe
PID 2588 wrote to memory of 1636	2588	X3 Foundry.exe	powershell.exe
PID 2588 wrote to memory of 1636	2588	X3 Foundry.exe	powershell.exe
PID 2588 wrote to memory of 1636	2588	X3 Foundry.exe	powershell.exe
PID 2588 wrote to memory of 976	2588	X3 Foundry.exe	powershell.exe
PID 2588 wrote to memory of 976	2588	X3 Foundry.exe	powershell.exe
PID 2588 wrote to memory of 976	2588	X3 Foundry.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe
"C:\Users\Admin\AppData\Local\Temp\80923a0d7111b0a1fa4326e3a9a0d9ecb7ce66e276f8672aa79e2b5d99473fab.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAZgB5ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAYgB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAYgB6ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAcwBsACMAPgA="
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Users\Admin\AppData\Roaming\X3 Libraries.exe
"C:\Users\Admin\AppData\Roaming\X3 Libraries.exe"
2⤵
- Executes dropped EXE
PID:2220

C:\Users\Admin\AppData\Roaming\X3 Foundry.exe
"C:\Users\Admin\AppData\Roaming\X3 Foundry.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\X3 Foundry.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'X3 Foundry.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Users\Admin\AppData\Roaming\X3.exe
"C:\Users\Admin\AppData\Roaming\X3.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9VZAA2RL00KFAWZEW58T.temp
Filesize
7KB

MD5
7fb72eac4575c9e550a2312d8dd113fd

SHA1
66d6f424d2b2d895615c005823a89f9aded74ddc

SHA256
e00873519d705f8722483abf31deff647ed7baea84cf7f0b0e5dae96f11145b7

SHA512
cd0553d3cd87a3a776583335c93e65c40ea08507d2f34751408f76549518f329f4343d80ce588abaf7b48e3614560ef2aa8aded5432dc62ed213e23e369028d6

Download Submit
\Users\Admin\AppData\Roaming\X3 Foundry.exe
Filesize
37KB

MD5
481dfe8fc19890a677c7824c60f721e8

SHA1
5db87becad1d847643fc853206feb3b33236dcd1

SHA256
3fb3f5a0edfedb7b6d05fe45f499df151d0b4b474c86f886ddc497106b6aefe5

SHA512
edf8d07242f349bc96d9b583641556019c6b11478794a6243786b814fed99d3778df74ede6d5e745038880a64abfc1a5537cb9fc03f42e835319487aa4f11e74

Download Submit
\Users\Admin\AppData\Roaming\X3 Libraries.exe
Filesize
701KB

MD5
17a4fe963bfec0ddadd74c1f39e8fd8f

SHA1
a857e89e506074bfedc937dc62fb1aa9e63e3281

SHA256
364492be3bc6462856177bb67acfc98ab80b751e22fd07d441fbcdc89754534e

SHA512
5aba4065f5c44163b4b9f479135d2e4c358bdc8ec273ac7acab0b40743633d0711d19999c019ddf991d428bb337b7840c29bc5ed093439758456d0272b9b7c9d

Download Submit
\Users\Admin\AppData\Roaming\X3.exe
Filesize
95KB

MD5
7875166307500da488a1618d9790e14c

SHA1
94219d3929064c36a1a60dd0a0b82c67f1038f4a

SHA256
1a328c71452450974247cf6126bbde1b1ab459bb1c6f56cc6f4c5626b8c9d386

SHA512
2ffacea5b936fe99d17c46c3a24450a1b95d0cb84c355a7deec6080b8f4fb6ec442280ea953621a20bac379d0b7f11e9ff18a489a0eee0cb1bb3366ea3ba9d4f

Download Submit
memory/976-36-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/976-37-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/1636-29-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/1636-30-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

Filesize
32KB

Download
memory/2220-23-0x0000000000E00000-0x0000000000EB6000-memory.dmp

Filesize
728KB

Download
memory/2588-24-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/2684-22-0x0000000001110000-0x000000000112E000-memory.dmp

Filesize
120KB

Download