Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-04-2024 13:18

General

  • Target

    75522ac685db9344eefd3400e24281b7e4f0f6166956bacd6d9f2724f493f5a3.exe

  • Size

    305KB

  • MD5

    50b2540d2b546c02bc9cd2cade97fd85

  • SHA1

    9b673e185c9dee14b56b13110837bf5f6a52c3dd

  • SHA256

    75522ac685db9344eefd3400e24281b7e4f0f6166956bacd6d9f2724f493f5a3

  • SHA512

    11296543a974dd1ae1c890bfa132a02d4158e83f280aff6c001fc1aee34dbe2bdcf762c428c48591b4a3e8add6ba7a4261103c2b1a34be5869ef7519835e01d0

  • SSDEEP

    6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75522ac685db9344eefd3400e24281b7e4f0f6166956bacd6d9f2724f493f5a3.exe
    "C:\Users\Admin\AppData\Local\Temp\75522ac685db9344eefd3400e24281b7e4f0f6166956bacd6d9f2724f493f5a3.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tmp4E2F.tmp

    Filesize

    2KB

    MD5

    1420d30f964eac2c85b2ccfe968eebce

    SHA1

    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

    SHA256

    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

    SHA512

    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

  • memory/3544-25-0x0000000006D50000-0x0000000006E5A000-memory.dmp

    Filesize

    1.0MB

  • memory/3544-35-0x0000000007CD0000-0x0000000007E92000-memory.dmp

    Filesize

    1.8MB

  • memory/3544-3-0x0000000005650000-0x00000000056E2000-memory.dmp

    Filesize

    584KB

  • memory/3544-4-0x00000000057B0000-0x00000000057C0000-memory.dmp

    Filesize

    64KB

  • memory/3544-5-0x0000000005700000-0x000000000570A000-memory.dmp

    Filesize

    40KB

  • memory/3544-1-0x0000000074910000-0x00000000750C1000-memory.dmp

    Filesize

    7.7MB

  • memory/3544-20-0x0000000005BF0000-0x0000000005C66000-memory.dmp

    Filesize

    472KB

  • memory/3544-26-0x0000000006C90000-0x0000000006CA2000-memory.dmp

    Filesize

    72KB

  • memory/3544-38-0x0000000074910000-0x00000000750C1000-memory.dmp

    Filesize

    7.7MB

  • memory/3544-2-0x0000000005CD0000-0x0000000006276000-memory.dmp

    Filesize

    5.6MB

  • memory/3544-21-0x0000000006BC0000-0x0000000006BDE000-memory.dmp

    Filesize

    120KB

  • memory/3544-27-0x0000000006CF0000-0x0000000006D2C000-memory.dmp

    Filesize

    240KB

  • memory/3544-28-0x0000000006E60000-0x0000000006EAC000-memory.dmp

    Filesize

    304KB

  • memory/3544-29-0x0000000006FA0000-0x0000000007006000-memory.dmp

    Filesize

    408KB

  • memory/3544-32-0x0000000007920000-0x0000000007970000-memory.dmp

    Filesize

    320KB

  • memory/3544-33-0x0000000074910000-0x00000000750C1000-memory.dmp

    Filesize

    7.7MB

  • memory/3544-34-0x00000000057B0000-0x00000000057C0000-memory.dmp

    Filesize

    64KB

  • memory/3544-0-0x0000000000B50000-0x0000000000BA2000-memory.dmp

    Filesize

    328KB

  • memory/3544-36-0x0000000008AC0000-0x0000000008FEC000-memory.dmp

    Filesize

    5.2MB

  • memory/3544-24-0x0000000007200000-0x0000000007818000-memory.dmp

    Filesize

    6.1MB