ScreenShot
| Created | 2023.10.31 07:47 | Machine | s1_win7_x6403 |
| Filename | sorta.exe | ||
| Type | PE32 executable (console) Intel 80386, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | |||
| md5 | 18db9adba53b6a650a413dce3dde8677 | ||
| sha256 | 8558a49ee89ad82ffac46831a5b2261438fd9b1713e50c94782d75e755b7a1f2 | ||
| ssdeep | 3072:uXkeDKokx5+UT5lSM4MnOMrylEr0Khb1oKGWDkXtdmI1f/ChUu4KNLxb:heDKok22lSM4Mn9pxb1oqKN4UmNh | ||
| imphash | 8896946f9800573d14f9b9f77774d4c8 | ||
| impfuzzy | 48:JdZ+fceMZt2QZcOucBZuF0Nq/eyWgn+vwv:TZ+fceMZtHZcXcruWlyyg | ||
Network IP location
Signature (15cnts)
| Level | Description |
|---|---|
| watch | Collects information about installed applications |
| watch | Communicates with host for which no DNS query was performed |
| watch | Harvests credentials from local FTP client softwares |
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | One or more potentially interesting buffers were extracted |
| notice | Queries for potentially installed applications |
| notice | Steals private information from local Internet browsers |
| info | Checks amount of memory in system |
| info | Checks if process is being debugged by a debugger |
| info | One or more processes crashed |
| info | Queries for the computername |
| info | The executable contains unknown PE section names indicative of a packer (could be a false positive) |
| info | Tries to locate where the browsers are installed |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (7cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (upload) |
| watch | Malicious_Library_Zero | Malicious_Library | binaries (upload) |
| watch | Malicious_Packer_Zero | Malicious Packer | binaries (upload) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE32 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Suricata ids
ET INFO Microsoft net.tcp Connection Initialization Activity
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET MALWARE Redline Stealer Activity (Response)
ET MALWARE Redline Stealer TCP CnC Activity
ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization)
ET MALWARE Redline Stealer TCP CnC - Id1Response
ET MALWARE Redline Stealer Activity (Response)
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 CreateEventW
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
kernel32.dll
0x44d750 DeployDatabase
0x44d754 MonitorEndpoint
0x44d758 OptimizeLog
0x44d75c ExploreAlgorithm
0x44d760 VisualizeRequest
0x44d764 CreateService
0x44d768 ExploreException
0x44d76c OptimizeTool
user32.dll
0x44d774 ExploreTool
0x44d778 SafeguardModule
0x44d77c ExploreArtifact
advapi32.dll
0x44d784 OptimizeAlgorithm
0x44d788 AutomateResource
0x44d78c MonitorProtocol
0x44d790 AuthorizeModule
EAT(Export Address Table) is none
KERNEL32.dll
0x41f000 WaitForSingleObject
0x41f004 Sleep
0x41f008 CreateThread
0x41f00c lstrlenW
0x41f010 VirtualProtect
0x41f014 GetProcAddress
0x41f018 LoadLibraryA
0x41f01c VirtualAlloc
0x41f020 GetModuleHandleA
0x41f024 CreateEventW
0x41f028 FreeConsole
0x41f02c InterlockedIncrement
0x41f030 InterlockedDecrement
0x41f034 WideCharToMultiByte
0x41f038 InterlockedExchange
0x41f03c InitializeCriticalSection
0x41f040 DeleteCriticalSection
0x41f044 EnterCriticalSection
0x41f048 LeaveCriticalSection
0x41f04c MultiByteToWideChar
0x41f050 GetLastError
0x41f054 HeapFree
0x41f058 HeapAlloc
0x41f05c RtlUnwind
0x41f060 RaiseException
0x41f064 TerminateProcess
0x41f068 GetCurrentProcess
0x41f06c UnhandledExceptionFilter
0x41f070 SetUnhandledExceptionFilter
0x41f074 IsDebuggerPresent
0x41f078 GetCommandLineA
0x41f07c GetCPInfo
0x41f080 LCMapStringA
0x41f084 LCMapStringW
0x41f088 HeapCreate
0x41f08c VirtualFree
0x41f090 HeapReAlloc
0x41f094 GetModuleHandleW
0x41f098 ExitProcess
0x41f09c WriteFile
0x41f0a0 GetStdHandle
0x41f0a4 GetModuleFileNameA
0x41f0a8 TlsGetValue
0x41f0ac TlsAlloc
0x41f0b0 TlsSetValue
0x41f0b4 TlsFree
0x41f0b8 SetLastError
0x41f0bc GetCurrentThreadId
0x41f0c0 FreeEnvironmentStringsA
0x41f0c4 GetEnvironmentStrings
0x41f0c8 FreeEnvironmentStringsW
0x41f0cc GetEnvironmentStringsW
0x41f0d0 SetHandleCount
0x41f0d4 GetFileType
0x41f0d8 GetStartupInfoA
0x41f0dc QueryPerformanceCounter
0x41f0e0 GetTickCount
0x41f0e4 GetCurrentProcessId
0x41f0e8 GetSystemTimeAsFileTime
0x41f0ec GetConsoleCP
0x41f0f0 GetConsoleMode
0x41f0f4 FlushFileBuffers
0x41f0f8 ReadFile
0x41f0fc SetFilePointer
0x41f100 CloseHandle
0x41f104 HeapSize
0x41f108 GetACP
0x41f10c GetOEMCP
0x41f110 IsValidCodePage
0x41f114 GetUserDefaultLCID
0x41f118 GetLocaleInfoA
0x41f11c EnumSystemLocalesA
0x41f120 IsValidLocale
0x41f124 GetStringTypeA
0x41f128 GetStringTypeW
0x41f12c InitializeCriticalSectionAndSpinCount
0x41f130 WriteConsoleA
0x41f134 GetConsoleOutputCP
0x41f138 WriteConsoleW
0x41f13c SetStdHandle
0x41f140 GetLocaleInfoW
0x41f144 CreateFileA
kernel32.dll
0x44d750 DeployDatabase
0x44d754 MonitorEndpoint
0x44d758 OptimizeLog
0x44d75c ExploreAlgorithm
0x44d760 VisualizeRequest
0x44d764 CreateService
0x44d768 ExploreException
0x44d76c OptimizeTool
user32.dll
0x44d774 ExploreTool
0x44d778 SafeguardModule
0x44d77c ExploreArtifact
advapi32.dll
0x44d784 OptimizeAlgorithm
0x44d788 AutomateResource
0x44d78c MonitorProtocol
0x44d790 AuthorizeModule
EAT(Export Address Table) is none