Analysis

  • max time kernel
    22s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 01:18

General

  • Target

    cc03430547aeb57a48bea8b42166aa5d67fa03097c8e6e1db055e30dc27e9baf.exe

  • Size

    1.1MB

  • MD5

    4ac5de9d55c788c81412dcf74816b202

  • SHA1

    16fbfc093f8bc4ba382bcbf52361cc8acfe4c2a4

  • SHA256

    cc03430547aeb57a48bea8b42166aa5d67fa03097c8e6e1db055e30dc27e9baf

  • SHA512

    3aac7dcca7baa365788d4829c9374054bb614da65fe81cf70deb8b22eec91f99b0fae87baabe13b2228ea7c3961200142aad8f875608bd8dcfa534e9fe18efc5

  • SSDEEP

    24576:CBWD95o5+hFcG4fVdx8Wx9YPt0Sx611O4sAG8y1:CBWgp3p2trxM1v/G51

Malware Config

Extracted

Family

redline

Botnet

crackcloud

C2

94.156.67.140:31957

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc03430547aeb57a48bea8b42166aa5d67fa03097c8e6e1db055e30dc27e9baf.exe
    "C:\Users\Admin\AppData\Local\Temp\cc03430547aeb57a48bea8b42166aa5d67fa03097c8e6e1db055e30dc27e9baf.exe"
    1⤵
      PID:3128
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,7545522914305657361,9950105517201397946,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8
      1⤵
        PID:4124

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3128-0-0x00000290A00E0000-0x00000290A00E1000-memory.dmp

        Filesize

        4KB

      • memory/3128-3-0x00000290B8AE0000-0x00000290B8B30000-memory.dmp

        Filesize

        320KB

      • memory/3128-2-0x00007FFD440D3000-0x00007FFD440D5000-memory.dmp

        Filesize

        8KB

      • memory/3128-1-0x00000290A00D0000-0x00000290A00D1000-memory.dmp

        Filesize

        4KB

      • memory/3128-4-0x00007FFD440D0000-0x00007FFD44B91000-memory.dmp

        Filesize

        10.8MB

      • memory/3128-5-0x00007FFD440D0000-0x00007FFD44B91000-memory.dmp

        Filesize

        10.8MB

      • memory/3128-8-0x00000290B8D40000-0x00000290B8D7C000-memory.dmp

        Filesize

        240KB

      • memory/3128-9-0x00007FFD440D0000-0x00007FFD44B91000-memory.dmp

        Filesize

        10.8MB

      • memory/3128-7-0x00000290B8CE0000-0x00000290B8CF2000-memory.dmp

        Filesize

        72KB

      • memory/3128-6-0x00000290B8DD0000-0x00000290B8EDA000-memory.dmp

        Filesize

        1.0MB

      • memory/3128-10-0x00000290B9100000-0x00000290B92C2000-memory.dmp

        Filesize

        1.8MB

      • memory/3128-11-0x00000290B9800000-0x00000290B9D28000-memory.dmp

        Filesize

        5.2MB

      • memory/3128-12-0x00007FFD440D0000-0x00007FFD44B91000-memory.dmp

        Filesize

        10.8MB