Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 22:03

General

  • Target

    2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe

  • Size

    479KB

  • MD5

    e821de3920101930f276babb770be5d9

  • SHA1

    946be878107032eea4d9d487e6689bf60b421eba

  • SHA256

    2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414

  • SHA512

    43eee2b89a56e8d1db9d07ca1e73dedd34642273bc6dd528284fe1cde5c98436dd193ac82e5eec210ed203e238a80ce36737496ada192e373c912503882ac82b

  • SSDEEP

    12288:8Mr4y90IFnDSTEnL0kJmCNqN2cFVwcBw8g:EyPFIk7qEcFec7g

Malware Config

Extracted

Family

redline

Botnet

diwer

C2

217.196.96.101:4132

Attributes
  • auth_value

    42abfa9e4f2e290c8bdbc776fd9bb6ad

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe
    "C:\Users\Admin\AppData\Local\Temp\2dc4a356558b229e53998e6c114b3697aa1cf08f3da6122b2d3c5b01c9790414.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2358444.exe

    Filesize

    307KB

    MD5

    0840e9dcd75121c32a5d7a4871500152

    SHA1

    67ce5ce53304bf284ccfba27e6a1cdb8b360c63b

    SHA256

    bc028e2f41ebb0838fc5eec10ccf90383ca4cc4cbc4d8d19e5d7cb5599b132bc

    SHA512

    4675cae3742ed62ce3d997f4879db2337e01b68671a08339722e7f134ea742eeffd4b080ceff27c0e6413569e23f78d65961364e426786efe3fe4d3214e5f8ee

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2275454.exe

    Filesize

    168KB

    MD5

    fec626e1ddc4aac7e6e26cf97d0fd3f0

    SHA1

    e240626ac0158f3da482f1d078c134e47b46af8c

    SHA256

    c828367fe1ab48ba851da06cbe9397babb915cf52c4ab135818088c85bff164a

    SHA512

    caa37fda143f48e644586ed1042583136df32b19129cb59a7e37dbec578c46aa74fa9c2d644119da85f7860c6f9ed03bd967dc8dd16203ed6f9df5cd04e693f4

  • memory/2460-14-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

    Filesize

    4KB

  • memory/2460-15-0x00000000006B0000-0x00000000006E0000-memory.dmp

    Filesize

    192KB

  • memory/2460-16-0x0000000002860000-0x0000000002866000-memory.dmp

    Filesize

    24KB

  • memory/2460-17-0x00000000055F0000-0x0000000005C08000-memory.dmp

    Filesize

    6.1MB

  • memory/2460-18-0x0000000005100000-0x000000000520A000-memory.dmp

    Filesize

    1.0MB

  • memory/2460-19-0x0000000005030000-0x0000000005042000-memory.dmp

    Filesize

    72KB

  • memory/2460-20-0x0000000005090000-0x00000000050CC000-memory.dmp

    Filesize

    240KB

  • memory/2460-21-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2460-22-0x0000000005210000-0x000000000525C000-memory.dmp

    Filesize

    304KB

  • memory/2460-23-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

    Filesize

    4KB

  • memory/2460-24-0x0000000073E40000-0x00000000745F0000-memory.dmp

    Filesize

    7.7MB