Analysis
- max time kernel
143s - max time network
154s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
24/07/2024, 16:21
General
- Target 784D1C11E45442987D0DF7E3EA6B29BE845C92B0415A5FE4763378062D3FA721.exe
- Size 372KB
- Sample240724-ttnfssvgql
- SHA256 cff416d5c061a2a5035b493bd39a10309f3b1e526b978e1cf07100b633d7939b
Malware Config
Extracted
-
redline
-
60n
-
193.106.191.123:34450
-
auth_value
c9bcbc8fac47ba6b7f3012eca29db0dc
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\784D1C11E45442987D0DF7E3EA6B29BE845C92B0415A5FE4763378062D3FA721.exe"C:\Users\Admin\AppData\Local\Temp\784D1C11E45442987D0DF7E3EA6B29BE845C92B0415A5FE4763378062D3FA721.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gnFyZB.exeC:\Users\Admin\AppData\Local\Temp\gnFyZB.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\363c432a.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
k2[1].rar
363c432a.bat
36DF32BC.exe
gnFyZB.exe
memory/1668-97-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-77-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-10-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1668-40-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/1668-41-0x0000000000250000-0x0000000000287000-memory.dmp
memory/1668-42-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1668-43-0x0000000000400000-0x0000000000489000-memory.dmp
memory/1668-44-0x0000000000570000-0x00000000005A0000-memory.dmp
memory/1668-45-0x00000000007B0000-0x00000000007DE000-memory.dmp
memory/1668-55-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-46-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-72-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-91-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-47-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-51-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-61-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-63-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-67-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-66-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-99-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-1-0x0000000000400000-0x0000000000489000-memory.dmp
memory/1668-96-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-4-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1668-93-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-73-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-87-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-85-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-83-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-81-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-79-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-75-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-89-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-69-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-59-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-57-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-53-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-49-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-101-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-109-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-107-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-105-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-103-0x00000000007B0000-0x00000000007D9000-memory.dmp
memory/1668-872-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1668-871-0x0000000000250000-0x0000000000287000-memory.dmp
memory/1668-870-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/2296-867-0x0000000000800000-0x0000000000809000-memory.dmp
memory/2296-11-0x0000000000800000-0x0000000000809000-memory.dmp