Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 18:07

General

  • Target

    e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e.exe

  • Size

    857KB

  • MD5

    e51f5ef0b3d5038c9e1b0b5516244e8c

  • SHA1

    d1d5a940665d849f900e8a369c29f0fac7c1374f

  • SHA256

    e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e

  • SHA512

    b5f4eccb3c51b84c315b966ea819b338b0cb8b6970b8c85749f123f9a6c06b0b76e64b29c303afc816b4c338860388d6f3c47e2a10f99828a7bd004de001c19b

  • SSDEEP

    12288:7MrFy90I/vsuqkr+jSMqxvObV/znJyyd34t6G6Gxzbj4kx2R2V/dBAo+HES2VN9T:myN/vXx+6GR/t37sJbj/fLAZ6Nlb9d

Malware Config

Extracted

Family

redline

Botnet

kira

C2

77.91.68.48:19071

Attributes
  • auth_value

    1677a40fd8997eb89377e1681911e9c6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e.exe
    "C:\Users\Admin\AppData\Local\Temp\e25842dbe6ab8469f81bd821ab70c2818962c7a681f45dfcd09f741409b2bb9e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4613386.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4613386.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f4035649.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f4035649.exe
        3⤵
        • Executes dropped EXE
        PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4613386.exe

    Filesize

    756KB

    MD5

    cf3f34f32dc4a452ca0f4d836908db49

    SHA1

    a4d13ea28196fea15ab933d5c4a566f836e5d7ae

    SHA256

    5529e10ffd4fabd413c2b5304c0ce9fbc74f34ef0658d4a412adb720eba49868

    SHA512

    df1375c03a5122ef5eac5493c66e10acfa4ded09706a43d49b0b0c952501d0e2d4ef69360f69ee0e0345bc3d048fd71e421b9587434cdfd415f05f7c0e9dedee

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f4035649.exe

    Filesize

    692KB

    MD5

    df7789aa0d0a80e21e5ee23b870e5cf1

    SHA1

    79bbce991030bb94b6f7fb29e6357bd13225095e

    SHA256

    774ac38f6596e453d65e442508c5e2182b2012ddaea6baea53e4075d9c23a4b0

    SHA512

    359fb9aaba0c44c103adb3c1662c15f2ec59504d69b31f6d1e10fd20dc5d5233c72c859ca62d54341c63d60bc28b01c55c07108fd1aa72c707c69014417dafb1

  • memory/4988-18-0x0000000000401000-0x0000000000402000-memory.dmp

    Filesize

    4KB

  • memory/4988-14-0x0000000000560000-0x0000000000590000-memory.dmp

    Filesize

    192KB

  • memory/4988-19-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4988-20-0x0000000002430000-0x0000000002436000-memory.dmp

    Filesize

    24KB

  • memory/4988-21-0x0000000009E50000-0x000000000A468000-memory.dmp

    Filesize

    6.1MB

  • memory/4988-22-0x000000000A500000-0x000000000A60A000-memory.dmp

    Filesize

    1.0MB

  • memory/4988-23-0x000000000A640000-0x000000000A652000-memory.dmp

    Filesize

    72KB

  • memory/4988-24-0x000000000A660000-0x000000000A69C000-memory.dmp

    Filesize

    240KB

  • memory/4988-25-0x0000000004480000-0x00000000044CC000-memory.dmp

    Filesize

    304KB