Analysis

  • max time kernel
    588s
  • max time network
    600s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13-11-2022 14:55

General

  • Target

    2423.sfx.exe

  • Size

    368KB

  • MD5

    a8b5a827e530c0eccd598e882c45ee16

  • SHA1

    56b7d4c0b5022a504696ca5ac17218e88d7869e3

  • SHA256

    bc5104f33b5a19b048ddb58e9bae390514d78631341acd9e098ffdb7114dbeef

  • SHA512

    091100a2200e910fad098246cfbb151672074a3b5b32b4facf759e7541cc19b13411cf619730e6befc4aa2b13255de33c48ed23f1adabcd1a167e3a52a2cb5fe

  • SSDEEP

    6144:2TouKrWBEu3/Z2lpGDHU3ykJotX+t41/pJ1FBPoWPJ8:2ToPWBv/cpGrU3yVtX+t4Vp/FBgeC

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

5

C2

95.217.102.105:23728

Attributes
  • auth_value

    296895f62ea120f06c6fcec4dcc5ed5b

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2423.sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\2423.sfx.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Users\Admin\AppData\Local\Temp\2423.exe
      "C:\Users\Admin\AppData\Local\Temp\2423.exe"
      2⤵
      • Executes dropped EXE
      PID:4848

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2423.exe
    Filesize

    137KB

    MD5

    adc399546530652e758999013f00367b

    SHA1

    60a843608baf23cc7789c68fc426f20b6dc29b41

    SHA256

    54d46f61cafb33d18862e4045a20d3dd802db35445be84c255bb62a50f5fcb65

    SHA512

    4dcc9a01e98aac84d44d3aa604809438903f2a4d004e01f07ce54a2ac01c55091015567019648c825140a33b4653b38ba9bf13ef1a9ef314c33cb0f18e1c5ad6

  • C:\Users\Admin\AppData\Local\Temp\2423.exe
    Filesize

    137KB

    MD5

    adc399546530652e758999013f00367b

    SHA1

    60a843608baf23cc7789c68fc426f20b6dc29b41

    SHA256

    54d46f61cafb33d18862e4045a20d3dd802db35445be84c255bb62a50f5fcb65

    SHA512

    4dcc9a01e98aac84d44d3aa604809438903f2a4d004e01f07ce54a2ac01c55091015567019648c825140a33b4653b38ba9bf13ef1a9ef314c33cb0f18e1c5ad6

  • memory/2628-120-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-121-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-122-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-123-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-126-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-125-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-128-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-129-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-130-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-131-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-133-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-134-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-132-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-135-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-136-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-137-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-138-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-139-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-140-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-141-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-142-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-143-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-144-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-145-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-146-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-147-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-148-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-149-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-150-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-151-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-152-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-153-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-154-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-155-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-156-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-157-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-158-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-159-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-160-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-161-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-162-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-163-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-164-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-165-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-166-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-167-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-168-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-169-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-170-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-171-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-172-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-173-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-174-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-175-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-176-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-177-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-178-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-179-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-180-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-181-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-182-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-183-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-184-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/2628-185-0x0000000077C80000-0x0000000077E0E000-memory.dmp
    Filesize

    1.6MB

  • memory/4848-187-0x0000000000000000-mapping.dmp
  • memory/4848-226-0x00000000005A0000-0x00000000005C8000-memory.dmp
    Filesize

    160KB

  • memory/4848-247-0x00000000054A0000-0x0000000005AA6000-memory.dmp
    Filesize

    6.0MB

  • memory/4848-248-0x0000000004FF0000-0x00000000050FA000-memory.dmp
    Filesize

    1.0MB

  • memory/4848-250-0x0000000004F30000-0x0000000004F42000-memory.dmp
    Filesize

    72KB

  • memory/4848-252-0x0000000004F90000-0x0000000004FCE000-memory.dmp
    Filesize

    248KB

  • memory/4848-254-0x0000000005100000-0x000000000514B000-memory.dmp
    Filesize

    300KB