Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 17:56
General
-
Target
file.exe
-
Size
894KB
-
MD5
837bbda2bbdf75c019f3581afb0fc9d4
-
SHA1
bdc6ea00d60dc2536788d737c53f29bd76248ed8
-
SHA256
a094b0cc4ae679c7cc50aaea4a59d08fb7db868148c7d0e79baf831d34d6171d
-
SHA512
61b2d2b955f4c15963412ba405c77cb58b017891ff2debe5625ad25ae880ffcc9264213566739739ca84e912411d87bce687eba51f478e93ae5cddde2856d637
-
SSDEEP
24576:0NA3R5drX/Wjw8to/ZAbGnVRqyiHOB8nDFQXi7hQHQ:V5OsVxYGnVRqyiHOi0i7hQw
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
193.233.255.84:4284
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\2.exe"C:\Windows\Temp\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
2KB
MD51680230bab7d192623f04d196c1dab68
SHA1f79f1fa47899be3136b76f92ac87302f93bde762
SHA256bfcc0524a78c04cc60ecb0922074f0e15cf3dc688fb8f55967b4f3f95eb36e4a
SHA5123ea22da961c85e07bb60008e562ae9b7a0d76cd8fb11e9a2bafddab2e07f7b77563d254e19f53b72b708b6736488d6c93f5b25097a337233f323bfdf3902a746
-
Filesize
2KB
MD5c4a0d7cf2725331ec1660f4215c5bbc1
SHA18d2137b41c12331958859d76c1dc2640f9d8efd8
SHA25605097e66a4cce22d99bd43f8b4116b346e84ff376ea44bf42a62c8accc5d2d3d
SHA5126eb6ffbcc43a9fd58a23429c76bb2738a148612ca687fe884e791649ff7e94732e4514c022ffe9f2657a7bb40d683ecda3f470f522478f4707e690b685a209b5
-
Filesize
323KB
MD5a0c6989730b44ee30722feccd86d946b
SHA14ef62e701352c7dfdf0807460dc4bb3c22be67f0
SHA2565669998000fdc457a919dea600b100809d0bb5681cbca6a67b544307233b5915
SHA512e5c622f22ad40cddae798853d40af4695a37bd75624193c0181504a3ac2a28c146339bf06ae0110a995c90bdfcaab9a3072e18a7f610cbed24d5b1d028fc5eba
-
Filesize
435KB
MD51f3cfcf8aad3e5e3164405d272aa213e
SHA196f1c646d19deab4ff071fbc6b3c73c87ce56e49
SHA256fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101
SHA5120d2008b613bed0f1bed205ace8e89d13d5b5e0fca924ca1f9d0e322564c7d7610e0e735e3686701d3042fef1c164dcd43e40a67eb60199b885fbcb761fa41b06
-
Filesize
7.7MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
1.0MB
-
Filesize
408KB
-
Filesize
328KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
424KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
448KB
-
Filesize
5.6MB
-
Filesize
424KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.1MB
-
Filesize
424KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
456KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB