Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
FieroHack.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
FieroHack.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
#/Sirus.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
#/Sirus.exe
Resource
win10v2004-20240508-en
General
-
Target
FieroHack.exe
-
Size
6.3MB
-
MD5
b88f61a7938ef8af011259c59efc3d3d
-
SHA1
ba6f4356993959799fbd88bb350558045c363a85
-
SHA256
640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2
-
SHA512
ba7a3564327f2ec4e0c34710205bdb297b8c4a29f020f973462897d52f4d99fefbb74c1f511195d2ac3bae0e44a8dc749cdf6d043ff5fba9939cdd73c59e7d40
-
SSDEEP
98304:0rLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvd6:uhIkwt+x31/CICj1lg6
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2608-34-0x0000000000DF0000-0x0000000000E3A000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
WeMod.exeSirus.exepid process 1692 WeMod.exe 2608 Sirus.exe -
Loads dropped DLL 3 IoCs
Processes:
FieroHack.exepid process 840 FieroHack.exe 840 FieroHack.exe 840 FieroHack.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
WeMod.exepid process 1692 WeMod.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WeMod.exeSirus.exepid process 1692 WeMod.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe 2608 Sirus.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Sirus.exedescription pid process Token: SeDebugPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeBackupPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe Token: SeSecurityPrivilege 2608 Sirus.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
FieroHack.exedescription pid process target process PID 840 wrote to memory of 1692 840 FieroHack.exe WeMod.exe PID 840 wrote to memory of 1692 840 FieroHack.exe WeMod.exe PID 840 wrote to memory of 1692 840 FieroHack.exe WeMod.exe PID 840 wrote to memory of 1692 840 FieroHack.exe WeMod.exe PID 840 wrote to memory of 2608 840 FieroHack.exe Sirus.exe PID 840 wrote to memory of 2608 840 FieroHack.exe Sirus.exe PID 840 wrote to memory of 2608 840 FieroHack.exe Sirus.exe PID 840 wrote to memory of 2608 840 FieroHack.exe Sirus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FieroHack.exe"C:\Users\Admin\AppData\Local\Temp\FieroHack.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\Local\Temp\Tar56ED.tmpFilesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
memory/840-9-0x0000000002E70000-0x00000000033B0000-memory.dmpFilesize
5.2MB
-
memory/840-2-0x0000000002E70000-0x00000000033B0000-memory.dmpFilesize
5.2MB
-
memory/1692-22-0x0000000077480000-0x0000000077629000-memory.dmpFilesize
1.7MB
-
memory/1692-13-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-16-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-26-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-25-0x0000000140241000-0x00000001404F0000-memory.dmpFilesize
2.7MB
-
memory/1692-24-0x000007FEFF580000-0x000007FEFF61F000-memory.dmpFilesize
636KB
-
memory/1692-11-0x0000000140241000-0x00000001404F0000-memory.dmpFilesize
2.7MB
-
memory/1692-20-0x000007FEFD3B0000-0x000007FEFD41C000-memory.dmpFilesize
432KB
-
memory/1692-15-0x0000000000500000-0x0000000000547000-memory.dmpFilesize
284KB
-
memory/1692-14-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-12-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-8-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/1692-10-0x000000013FFB0000-0x00000001404F0000-memory.dmpFilesize
5.2MB
-
memory/2608-35-0x0000000074680000-0x0000000074D6E000-memory.dmpFilesize
6.9MB
-
memory/2608-34-0x0000000000DF0000-0x0000000000E3A000-memory.dmpFilesize
296KB
-
memory/2608-33-0x000000007468E000-0x000000007468F000-memory.dmpFilesize
4KB
-
memory/2608-73-0x000000007468E000-0x000000007468F000-memory.dmpFilesize
4KB
-
memory/2608-74-0x0000000074680000-0x0000000074D6E000-memory.dmpFilesize
6.9MB