Overview

overview

10

Static

static

3

0f6ce02639...df.exe

windows10-2004-x64

10

17dbf09aca...d0.exe

windows7-x64

3

17dbf09aca...d0.exe

windows10-2004-x64

10

1b624e343d...55.exe

windows10-2004-x64

10

2faa75c50b...6d.exe

windows7-x64

3

2faa75c50b...6d.exe

windows10-2004-x64

10

4be1f370e8...6b.exe

windows7-x64

3

4be1f370e8...6b.exe

windows10-2004-x64

10

576cad65a8...60.exe

windows10-2004-x64

10

6aa8d5d0d6...df.exe

windows10-2004-x64

10

6eeb3d69d9...69.exe

windows7-x64

3

6eeb3d69d9...69.exe

windows10-2004-x64

10

77b8709187...06.exe

windows7-x64

3

77b8709187...06.exe

windows10-2004-x64

10

7f4e227924...bb.exe

windows7-x64

3

7f4e227924...bb.exe

windows10-2004-x64

10

8a870280a0...35.exe

windows7-x64

3

8a870280a0...35.exe

windows10-2004-x64

10

8db6f54494...1f.exe

windows10-2004-x64

10

b21367ffaa...ef.exe

windows10-2004-x64

10

b62068be50...da.exe

windows10-2004-x64

10

be5114d10d...f3.exe

windows10-2004-x64

10

d191282ff4...7a.exe

windows10-2004-x64

10

de9167b772...91.exe

windows10-2004-x64

10

f6dc0b4c65...d6.exe

windows10-2004-x64

10

f85eca1ce9...65.exe

windows7-x64

3

f85eca1ce9...65.exe

windows10-2004-x64

10

f8dfa98c4e...be.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 14:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069.exe

  • Size

    527KB

  • MD5

    e37cabc57eb01eeee18f0fe54dbf50ed

  • SHA1

    2d8fb6568c8b5bee977bf86c45295ec17943e1ae

  • SHA256

    6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069

  • SHA512

    115cc30d1e2c0ac66ed22908e2f433209d318b79b58e2df5b2b2e44b3890208c87abe5147d21009b3f5362f7bca79324ae1c44d916232981813fdd2e8c89314a

  • SSDEEP

    12288:HZIeNiEvQJt6ygIYBz0birVU2fROWON90Xp:HZIsvQwzHHh1

Score
10/10
redline@nmrzv88discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@nmrzv88

C2

147.45.47.93:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069.exe
    "C:\Users\Admin\AppData\Local\Temp\6eeb3d69d9979df74b9c482de2344395f5470b94f07494b4a4dd74fb5d286069.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5076

Network

  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    2.17.196.155:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Fri, 10 May 2024 14:51:06 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.97c41102.1715352666.389cfe25
  • flag-us
    DNS
    155.196.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    155.196.17.2.in-addr.arpa
    IN PTR
    Response
    155.196.17.2.in-addr.arpa
    IN PTR
    a2-17-196-155deploystaticakamaitechnologiescom
  • flag-us
    DNS
    93.47.45.147.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    93.47.45.147.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.ip.sb
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ip.sb
    IN A
    Response
    api.ip.sb
    IN CNAME
    api.ip.sb.cdn.cloudflare.net
    api.ip.sb.cdn.cloudflare.net
    IN A
    172.67.75.172
    api.ip.sb.cdn.cloudflare.net
    IN A
    104.26.12.31
    api.ip.sb.cdn.cloudflare.net
    IN A
    104.26.13.31
  • flag-us
    GET
    https://api.ip.sb/ip
    RegAsm.exe
    Remote address:
    172.67.75.172:443
    Request
    GET /ip HTTP/1.1
    Host: api.ip.sb
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 10 May 2024 14:51:11 GMT
    Content-Type: text/plain
    Transfer-Encoding: chunked
    Connection: keep-alive
    vary: Accept-Encoding
    Cache-Control: no-cache
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pJ9E4xZfA441FhG66Ypugd7Ei15WSOEHG0vlGzz8DViPZDZXl22wUrBYDRXmC8BOhs07dWCFQKtsTjRvwKBqDO3d2qSMmsr8jQ9595yyrZWjeKwEt8Se6BOxkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    Server: cloudflare
    CF-RAY: 881abef5bbf16341-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    172.75.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.75.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    23.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.173.189.20.in-addr.arpa
    IN PTR
    Response
  • 147.45.47.93:80
    http
    RegAsm.exe
    2.0MB
     27.4kB
     1426
    489
  • 2.17.196.155:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.4kB
     6.3kB
     16
    10

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 172.67.75.172:443
    https://api.ip.sb/ip
    tls, http
    RegAsm.exe
    756 B
     5.8kB
     9
    10

    HTTP Request

    GET https://api.ip.sb/ip

    HTTP Response

    200
  • 195.20.16.153:80
    RegAsm.exe
    260 B
     5
  • 195.20.16.153:80
    RegAsm.exe
    260 B
     5
  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    155.196.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    155.196.17.2.in-addr.arpa

  • 8.8.8.8:53
    93.47.45.147.in-addr.arpa
    dns
    71 B
     126 B
     1
    1

    DNS Request

    93.47.45.147.in-addr.arpa

  • 8.8.8.8:53
    api.ip.sb
    dns
    RegAsm.exe
    55 B
     145 B
     1
    1

    DNS Request

    api.ip.sb

    DNS Response

    172.67.75.172
    104.26.12.31
    104.26.13.31

  • 8.8.8.8:53
    172.75.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    172.75.67.172.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    98.56.20.217.in-addr.arpa
    dns
    71 B
     131 B
     1
    1

    DNS Request

    98.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    23.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Tmp4C6A.tmp
    Filesize

    2KB

    MD5

    1420d30f964eac2c85b2ccfe968eebce

    SHA1

    bdf9a6876578a3e38079c4f8cf5d6c79687ad750

    SHA256

    f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

    SHA512

    6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

    Download Submit

  • memory/2972-3-0x0000000001080000-0x0000000001081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2972-1-0x0000000001080000-0x0000000001081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2972-0-0x0000000001080000-0x0000000001081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5076-29-0x0000000006E60000-0x0000000007478000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/5076-30-0x00000000086E0000-0x00000000087EA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/5076-6-0x00000000050B0000-0x0000000005142000-memory.dmp

    Filesize

    584KB

    Download

  • memory/5076-7-0x0000000005180000-0x000000000518A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/5076-8-0x0000000074720000-0x0000000074ED0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5076-4-0x000000007472E000-0x000000007472F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5076-25-0x0000000005D60000-0x0000000005DD6000-memory.dmp

    Filesize

    472KB

    Download

  • memory/5076-26-0x00000000064D0000-0x00000000064EE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/5076-2-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download

  • memory/5076-5-0x0000000005730000-0x0000000005CD4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/5076-31-0x0000000006CB0000-0x0000000006CC2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/5076-32-0x0000000006D10000-0x0000000006D4C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5076-33-0x0000000006930000-0x000000000697C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/5076-36-0x0000000009160000-0x00000000091C6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/5076-37-0x000000000A3E0000-0x000000000A5A2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/5076-38-0x000000000AAE0000-0x000000000B00C000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/5076-39-0x0000000009790000-0x00000000097E0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/5076-40-0x000000007472E000-0x000000007472F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5076-41-0x0000000074720000-0x0000000074ED0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/5076-43-0x0000000074720000-0x0000000074ED0000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.