Analysis

  • max time kernel
    31s
  • max time network
    41s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240704-en
  • resource tags

    arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-07-2024 09:59

General

  • Target

    UpdateSSSS.exe

  • Size

    575KB

  • MD5

    ad2867dc002af2cca594f0b8202a1843

  • SHA1

    73b3ea99db621b71e7a4a13720c53ebe3a815521

  • SHA256

    2c0e4b4e5535c97fbf45309cbe7ff05006f06db1f3bf31983c7b0e7a7753900d

  • SHA512

    cfb6c5f1333187e0e807a3b2beb72cb50805fac403b900242afce017ccde5a677d7b8c6be86fb9933db64103cb78b17c57fdec4c764f14c89793a5ec3e309108

  • SSDEEP

    12288:f3BBr+brWXKteOPMQcVoCpLDvI1qAyY5A7BN9Optiyk/bk/kGhUA8890i/S/Cx2r:fbiDtFEi

Malware Config

Extracted

Family

redline

C2

185.196.9.26:6302

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UpdateSSSS.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdateSSSS.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\d3d9.dll

    Filesize

    437KB

    MD5

    106fe1980dbcb4fa2fe0c00b6d6fa7c2

    SHA1

    5cb7eb7be8f3d1641cb458024d868363658a2955

    SHA256

    c0716389100b55b09f46fafef37bb7d120453df3bfb1097dcd30e14bb97c09bc

    SHA512

    c9d48c5f5ecf83012f1cc16581b7bb283265a3808847af46195987c7b0721116fe7241185d67b5d7636080881da5f18df04e57e309ff5a133046dd87ca8d06ce

  • memory/3368-15-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/3368-1-0x0000000000180000-0x0000000000218000-memory.dmp

    Filesize

    608KB

  • memory/3368-2-0x0000000002660000-0x0000000002666000-memory.dmp

    Filesize

    24KB

  • memory/3368-3-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/3368-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

    Filesize

    4KB

  • memory/3368-10-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/3368-13-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/4144-18-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/4144-21-0x0000000005770000-0x000000000587A000-memory.dmp

    Filesize

    1.0MB

  • memory/4144-16-0x0000000005950000-0x0000000005EF6000-memory.dmp

    Filesize

    5.6MB

  • memory/4144-17-0x0000000005440000-0x00000000054D2000-memory.dmp

    Filesize

    584KB

  • memory/4144-11-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/4144-19-0x0000000005430000-0x000000000543A000-memory.dmp

    Filesize

    40KB

  • memory/4144-20-0x0000000006520000-0x0000000006B38000-memory.dmp

    Filesize

    6.1MB

  • memory/4144-14-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB

  • memory/4144-22-0x00000000056A0000-0x00000000056B2000-memory.dmp

    Filesize

    72KB

  • memory/4144-23-0x0000000005700000-0x000000000573C000-memory.dmp

    Filesize

    240KB

  • memory/4144-24-0x0000000005880000-0x00000000058CC000-memory.dmp

    Filesize

    304KB

  • memory/4144-25-0x0000000005FB0000-0x0000000006016000-memory.dmp

    Filesize

    408KB

  • memory/4144-26-0x0000000006F00000-0x0000000006F50000-memory.dmp

    Filesize

    320KB

  • memory/4144-27-0x0000000007220000-0x00000000073E2000-memory.dmp

    Filesize

    1.8MB

  • memory/4144-28-0x0000000007920000-0x0000000007E4C000-memory.dmp

    Filesize

    5.2MB

  • memory/4144-30-0x00000000750D0000-0x0000000075881000-memory.dmp

    Filesize

    7.7MB