Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 01:16

General

  • Target

    ba8b5e47d1d20028cd7ddb4ea828ebc9e8b7d4c67b332544b8cd253ad606e3c4.exe

  • Size

    1.5MB

  • MD5

    27a8a92f7b2d4ec7977165d5b6aac135

  • SHA1

    0ca94d3c5e5fcb6ee0952ec2a9c2e98f5a27c700

  • SHA256

    ba8b5e47d1d20028cd7ddb4ea828ebc9e8b7d4c67b332544b8cd253ad606e3c4

  • SHA512

    da6ef0bd87e597efaa7791d25958039b0bb910532555c8d9c8d542fa38ffc302fbd156f06c0d72db9af647272d77032a65458dc804a220175d1d60a518e27a6f

  • SSDEEP

    12288:akprWrfjIMvv+XHw2dOb25Z2TVPFGhWI/CIbYOE/IBikjUGuR:ErAXHw9trGs8CnOliAUh

Malware Config

Extracted

Family

redline

Botnet

VIP

C2

173.195.100.68:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba8b5e47d1d20028cd7ddb4ea828ebc9e8b7d4c67b332544b8cd253ad606e3c4.exe
    "C:\Users\Admin\AppData\Local\Temp\ba8b5e47d1d20028cd7ddb4ea828ebc9e8b7d4c67b332544b8cd253ad606e3c4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
        PID:3160

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4748-10-0x00000000053D0000-0x00000000053DA000-memory.dmp

      Filesize

      40KB

    • memory/4748-16-0x00000000063C0000-0x000000000640C000-memory.dmp

      Filesize

      304KB

    • memory/4748-20-0x000000000A1D0000-0x000000000A6FC000-memory.dmp

      Filesize

      5.2MB

    • memory/4748-19-0x00000000090C0000-0x0000000009282000-memory.dmp

      Filesize

      1.8MB

    • memory/4748-18-0x0000000008D70000-0x0000000008DC0000-memory.dmp

      Filesize

      320KB

    • memory/4748-5-0x0000000000400000-0x0000000000452000-memory.dmp

      Filesize

      328KB

    • memory/4748-6-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

      Filesize

      4KB

    • memory/4748-7-0x0000000005900000-0x0000000005EA4000-memory.dmp

      Filesize

      5.6MB

    • memory/4748-12-0x00000000069D0000-0x0000000006FE8000-memory.dmp

      Filesize

      6.1MB

    • memory/4748-9-0x0000000074BB0000-0x0000000075360000-memory.dmp

      Filesize

      7.7MB

    • memory/4748-22-0x0000000074BB0000-0x0000000075360000-memory.dmp

      Filesize

      7.7MB

    • memory/4748-17-0x0000000006530000-0x0000000006596000-memory.dmp

      Filesize

      408KB

    • memory/4748-8-0x00000000053F0000-0x0000000005482000-memory.dmp

      Filesize

      584KB

    • memory/4748-14-0x0000000008250000-0x0000000008262000-memory.dmp

      Filesize

      72KB

    • memory/4748-13-0x0000000008360000-0x000000000846A000-memory.dmp

      Filesize

      1.0MB

    • memory/4748-15-0x00000000082B0000-0x00000000082EC000-memory.dmp

      Filesize

      240KB

    • memory/4952-1-0x00007FF9E57C3000-0x00007FF9E57C5000-memory.dmp

      Filesize

      8KB

    • memory/4952-2-0x000001E1F7DD0000-0x000001E1F7DDE000-memory.dmp

      Filesize

      56KB

    • memory/4952-4-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

      Filesize

      10.8MB

    • memory/4952-3-0x000001E1F7FB0000-0x000001E1F8054000-memory.dmp

      Filesize

      656KB

    • memory/4952-11-0x00007FF9E57C0000-0x00007FF9E6281000-memory.dmp

      Filesize

      10.8MB

    • memory/4952-0-0x000001E1DD980000-0x000001E1DD98E000-memory.dmp

      Filesize

      56KB