Analysis

  • max time kernel
    189s
  • max time network
    201s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2023 11:21

General

  • Target

    redline.exe

  • Size

    631KB

  • MD5

    2345c226577de700a9158518531baf1d

  • SHA1

    7fbb1b7cfe5705c22b63b0867b4e9ea742c3d0b7

  • SHA256

    1479a6a608f751577c1b87438adeaf13211690dc1e8931715d5a3cab0572e316

  • SHA512

    539197f0808eb33fffe426aa718891cf4be05d23aab208b49b97b5ba03e31d1602c1febcb1a66961336b893bae48a384ec51f1c762803ca23456c0bf97e786a0

  • SSDEEP

    12288:Dd9VHRFi5j/7YsGp9Tk4nKZUGT4p5gTbARgDBL:5RLT2ypUcsBL

Malware Config

Extracted

Family

redline

C2

54.38.9.216:9487

Attributes
  • auth_value

    9bde7608ef33d6cbd8c01687cdd53196

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\redline.exe
    "C:\Users\Admin\AppData\Local\Temp\redline.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      2⤵
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UnlockApprove.cfg
    1⤵
    • Modifies registry class
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2180-0-0x0000000000B50000-0x0000000000BF0000-memory.dmp

    Filesize

    640KB

  • memory/2180-1-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2180-2-0x000000001B600000-0x000000001B680000-memory.dmp

    Filesize

    512KB

  • memory/2180-13-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

    Filesize

    9.9MB

  • memory/2592-3-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-4-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-5-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-6-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2592-8-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-10-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2592-12-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB