Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 12:11

General

  • Target

    e72a6e51dbac1e6313459eab1ffc1832d973b0fd23fe10aba5acdee9ba028f6d.exe

  • Size

    853KB

  • MD5

    03c70427b7f46efb268904efce07e208

  • SHA1

    6201e0eb7f063348a80543fce2e4f92f064624b6

  • SHA256

    e72a6e51dbac1e6313459eab1ffc1832d973b0fd23fe10aba5acdee9ba028f6d

  • SHA512

    28112660c5df88ef4affbf1cf27105f54bb25f532d6d820d9ff8d72bf02a29dc2b3b3fe211c7383db7cb49ec6caec7d238ceac70cce8f29bd650aaa9958f78d4

  • SSDEEP

    24576:gydW77VD+If1MjC21MKDHlSX6YdG16mys76:ndY7N+7RKeH0XXA6mn7

Malware Config

Extracted

Family

redline

Botnet

kira

C2

77.91.68.48:19071

Attributes
  • auth_value

    1677a40fd8997eb89377e1681911e9c6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e72a6e51dbac1e6313459eab1ffc1832d973b0fd23fe10aba5acdee9ba028f6d.exe
    "C:\Users\Admin\AppData\Local\Temp\e72a6e51dbac1e6313459eab1ffc1832d973b0fd23fe10aba5acdee9ba028f6d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1528662.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1528662.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f7382281.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f7382281.exe
        3⤵
        • Executes dropped EXE
        PID:720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1528662.exe

    Filesize

    752KB

    MD5

    825d5e2098da7edd0c17fac952d6d721

    SHA1

    d44c1a96f5ffb32a8bb7ea72208a79cd4095b1fd

    SHA256

    49c98de2deb82f2134ed6b01213a6c063719e1e263c4468b8ba55342c4864a2b

    SHA512

    0d32ad9e6105e7885dc52d6ef434ca2536af2ca3f89841eb72e905b47bf345a9f9e6a92d4844b6f0911ca2a4612b1ebf4d33b2ad05d5e891d0ed471644c2dd3d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f7382281.exe

    Filesize

    692KB

    MD5

    1c4dcd796dc1a5ad10db4a05a2178325

    SHA1

    f0d182ea2e5842e33a6e1075b002d3b426baeb7f

    SHA256

    3fbe14a076fd872f94dec8ce14edc7f6b05442b16a31da805585a36cc5b55090

    SHA512

    84fabc37a9787bb89add60da24fa769d2144247ae09dce1647514145b8eed551db541ec6fdfe84f29662970cbb4981539e6c03241b449464928831a2859bdcac

  • memory/720-15-0x0000000001DE0000-0x0000000001E10000-memory.dmp

    Filesize

    192KB

  • memory/720-18-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/720-19-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/720-20-0x0000000002390000-0x0000000002396000-memory.dmp

    Filesize

    24KB

  • memory/720-21-0x00000000051E0000-0x00000000057F8000-memory.dmp

    Filesize

    6.1MB

  • memory/720-22-0x0000000004C00000-0x0000000004D0A000-memory.dmp

    Filesize

    1.0MB

  • memory/720-23-0x0000000004D40000-0x0000000004D52000-memory.dmp

    Filesize

    72KB

  • memory/720-24-0x0000000004D60000-0x0000000004D9C000-memory.dmp

    Filesize

    240KB

  • memory/720-25-0x0000000004E00000-0x0000000004E4C000-memory.dmp

    Filesize

    304KB