Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 15:28

General

  • Target

    71829948467d2f16aa6d5c19d4887b4da3a316c3778ff88b4130bc047d02f5ce.exe

  • Size

    306KB

  • MD5

    6ee7eb36e567f6e466aaaf24c199df75

  • SHA1

    b0c3b1eaf357df0d49b6db112d91f5b863f05253

  • SHA256

    71829948467d2f16aa6d5c19d4887b4da3a316c3778ff88b4130bc047d02f5ce

  • SHA512

    dda4269111e1fee9ce47c059884171e43cb165916976763e4cfe484b9bd5dcc12269a4544fb01f1602a168ae920df31de1a06d03c3121560d5388644c0dae743

  • SSDEEP

    6144:mUZl9vSWh60RVAtljy11j8A/QGetb58moOBJyL98R:bZKWhHJBYGetvhDyL98R

Malware Config

Extracted

Family

redline

Botnet

5195552529

C2

https://pastebin.com/raw/NgsUAPya

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71829948467d2f16aa6d5c19d4887b4da3a316c3778ff88b4130bc047d02f5ce.exe
    "C:\Users\Admin\AppData\Local\Temp\71829948467d2f16aa6d5c19d4887b4da3a316c3778ff88b4130bc047d02f5ce.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2684
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2680
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1344
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 320
          2⤵
          • Program crash
          PID:2672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4656 -ip 4656
        1⤵
          PID:2240

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1344-8-0x0000000006A00000-0x0000000006A3C000-memory.dmp

          Filesize

          240KB

        • memory/1344-2-0x00000000744FE000-0x00000000744FF000-memory.dmp

          Filesize

          4KB

        • memory/1344-9-0x0000000006A40000-0x0000000006A8C000-memory.dmp

          Filesize

          304KB

        • memory/1344-10-0x0000000006D80000-0x0000000006F42000-memory.dmp

          Filesize

          1.8MB

        • memory/1344-4-0x00000000061E0000-0x00000000067F8000-memory.dmp

          Filesize

          6.1MB

        • memory/1344-5-0x0000000005C20000-0x0000000005C32000-memory.dmp

          Filesize

          72KB

        • memory/1344-6-0x0000000005D50000-0x0000000005E5A000-memory.dmp

          Filesize

          1.0MB

        • memory/1344-7-0x00000000744F0000-0x0000000074CA0000-memory.dmp

          Filesize

          7.7MB

        • memory/1344-18-0x00000000744F0000-0x0000000074CA0000-memory.dmp

          Filesize

          7.7MB

        • memory/1344-0-0x0000000000400000-0x0000000000422000-memory.dmp

          Filesize

          136KB

        • memory/1344-3-0x0000000005690000-0x00000000056F6000-memory.dmp

          Filesize

          408KB

        • memory/1344-11-0x0000000007480000-0x00000000079AC000-memory.dmp

          Filesize

          5.2MB

        • memory/1344-12-0x0000000007F60000-0x0000000008504000-memory.dmp

          Filesize

          5.6MB

        • memory/1344-13-0x00000000070F0000-0x0000000007182000-memory.dmp

          Filesize

          584KB

        • memory/1344-14-0x0000000006F50000-0x0000000006FA0000-memory.dmp

          Filesize

          320KB

        • memory/1344-15-0x0000000007020000-0x0000000007096000-memory.dmp

          Filesize

          472KB

        • memory/1344-16-0x0000000006FA0000-0x0000000006FBE000-memory.dmp

          Filesize

          120KB

        • memory/4656-1-0x0000000000578000-0x0000000000579000-memory.dmp

          Filesize

          4KB