Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 03:47

General

  • Target

    Setup.exe

  • Size

    777KB

  • MD5

    609dc8041c85d08ca88532beda64010b

  • SHA1

    a3f016ce71a6e39529f3e270f70baa4aa5a4d66a

  • SHA256

    5eddb42cd21a88637770326bea9ae489ea4b1e3076adf38e1f1021a2deacf194

  • SHA512

    e8ba403f37d5f3b59e8f6ee54665c9c7dc6c1732cfe0c5c18d4c5049b760a4bac58b10a2f4dc84ba7e40f04548222cd72eb390df7356af9152dbcb0960adb984

  • SSDEEP

    12288:arOHiaskkwFRa+BbM68oXwKo4UBI6ataVOVnjsuXhdKwa3Kj5jtG96L/315HxUJx:bCpkkUhlAKoBJ7j

Malware Config

Extracted

Family

redline

Botnet

5664290451

C2

https://pastebin.com/raw/NgsUAPya

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\d3d9.dll

    Filesize

    205KB

    MD5

    f9518ffe8440bb06e5cefa90d928aed8

    SHA1

    364b74d3f1f4d967a95e066c695209e6deb0d1b2

    SHA256

    dda11b2d41246c39473f2266df03399d9fd9c68be8f84a601a5ba3cf4b51d305

    SHA512

    5e15d08887d223f3c6acc1711a7030306438d297402c79848a3588d40bb88b816cf5a735be043dcff328219ac3d3c4141364ffa7b790201e97f3fdf7f24bcd79

  • memory/1904-17-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/1904-22-0x0000000007A30000-0x0000000007FD4000-memory.dmp

    Filesize

    5.6MB

  • memory/1904-16-0x00000000056D0000-0x00000000057DA000-memory.dmp

    Filesize

    1.0MB

  • memory/1904-28-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/1904-9-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1904-11-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/1904-26-0x0000000007910000-0x0000000007960000-memory.dmp

    Filesize

    320KB

  • memory/1904-13-0x0000000005070000-0x00000000050D6000-memory.dmp

    Filesize

    408KB

  • memory/1904-14-0x0000000005B10000-0x0000000006128000-memory.dmp

    Filesize

    6.1MB

  • memory/1904-15-0x00000000055A0000-0x00000000055B2000-memory.dmp

    Filesize

    72KB

  • memory/1904-30-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/1904-27-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/1904-20-0x0000000006850000-0x0000000006A12000-memory.dmp

    Filesize

    1.8MB

  • memory/1904-19-0x0000000006530000-0x000000000657C000-memory.dmp

    Filesize

    304KB

  • memory/1904-18-0x0000000005AB0000-0x0000000005AEC000-memory.dmp

    Filesize

    240KB

  • memory/1904-21-0x0000000006F50000-0x000000000747C000-memory.dmp

    Filesize

    5.2MB

  • memory/1904-25-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

    Filesize

    120KB

  • memory/1904-23-0x0000000006A20000-0x0000000006AB2000-memory.dmp

    Filesize

    584KB

  • memory/1904-24-0x0000000006B40000-0x0000000006BB6000-memory.dmp

    Filesize

    472KB

  • memory/4076-2-0x00000000032B0000-0x00000000032B6000-memory.dmp

    Filesize

    24KB

  • memory/4076-12-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB

  • memory/4076-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

    Filesize

    4KB

  • memory/4076-1-0x0000000000FC0000-0x000000000108C000-memory.dmp

    Filesize

    816KB

  • memory/4076-3-0x00000000744E0000-0x0000000074C90000-memory.dmp

    Filesize

    7.7MB