Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 22:38
General
-
Target
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe
-
Size
894KB
-
MD5
826eb90d730bf03e39d78daa585364bc
-
SHA1
d139eee9235e1f997ef14f014c7fbc3dd3b36a03
-
SHA256
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e
-
SHA512
c5e50071603a0f7f8e27098a7272f8fa9d987c6daba1104890afa354f1c2ba506c2476911e306d0bae99772159f2462b3f61e844b608b1e1ea0463df22a33d42
-
SSDEEP
24576:0NA3R5drX/WfwOauc1XayZWtTHOB8nDFQXi7hQHX:V5OfwOg1KyMHOi0i7hQ3
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
193.233.255.84:4284
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\2.exe"C:\Windows\Temp\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
79B
MD5bbc8da7d36df3f91c460984c2abe8419
SHA19a247c3d293022fde4f3abc8b56259275c4ef97c
SHA2560399ccf5e780949a63400736a46cce7d1879903d0f45c6b7d194c960ba4dddc2
SHA512facbe33baa35fccf8072fe207a4d5eda2a64c4ed067c8eecb23e49cb003747be4c3772cb4ae2dfb87f91aa711b9a8371a2e0d76dc40830e275098172318d7cb4
-
Filesize
2KB
MD5d39f6f85b57baa22c30560b8ad116acb
SHA14936b64cee8787cc71fb17206f068da9913ee6b3
SHA2569cc98f46d321058cdaf69c0f727b071c61edf75dc7fd4d6b5db04a02aa175bdf
SHA51295798be62e29b1f0eebaaed4d752e055c40690b55c68465e65bfa9959bcc24586c73f9d76eb0d678142688b5ca40d528d276742c2b7c25776c4954a14b4ef511
-
Filesize
323KB
MD58214daede69a0da8327553bd9f8ae499
SHA1334655ca2474e04b411f064e86d4bbfd3b6b19f8
SHA2560d968172eebfc13e25d0e70b2d476e5711fc2e96604bbcfdfd89c0c157e7a61f
SHA512f8c8fa7344b5e9da9cbc835b71aac984ef6712b52101937074c0908e2bfc8fc01f875484ace40292c542bcb93196cac7267433e2cd5f4444878856b822101d3c
-
Filesize
435KB
MD51f3cfcf8aad3e5e3164405d272aa213e
SHA196f1c646d19deab4ff071fbc6b3c73c87ce56e49
SHA256fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101
SHA5120d2008b613bed0f1bed205ace8e89d13d5b5e0fca924ca1f9d0e322564c7d7610e0e735e3686701d3042fef1c164dcd43e40a67eb60199b885fbcb761fa41b06
-
Filesize
328KB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
448KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB