Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 00:00

General

  • Target

    2fa00aa969dfca6236354a5d77fe9a686066a20b40909689ad3dacafca5f7604.exe

  • Size

    440KB

  • MD5

    d77e798461d2f582cae849d7108d6169

  • SHA1

    5261f32940dd983f5c78c30f75439342bf69fed1

  • SHA256

    2fa00aa969dfca6236354a5d77fe9a686066a20b40909689ad3dacafca5f7604

  • SHA512

    93a2221c448586ab56098bae9318728b65461b920b78db5870f1e524d11778f42fef5b1d6888d3c6c1014d43897b82dd495c5bf03e4c113cfd1f29986170d731

  • SSDEEP

    12288:tMrRy90WVPFoJ6fNwvvIXVdz8/J5FM4L:Iynk6VUO23fL

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fa00aa969dfca6236354a5d77fe9a686066a20b40909689ad3dacafca5f7604.exe
    "C:\Users\Admin\AppData\Local\Temp\2fa00aa969dfca6236354a5d77fe9a686066a20b40909689ad3dacafca5f7604.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ebJ51ed55.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ebJ51ed55.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ebJ51ed55.exe

    Filesize

    343KB

    MD5

    962852f5ddb9fecb794be023a3c88a12

    SHA1

    d60d53b1cd4ca2f73408cb7912ac79dd0674b863

    SHA256

    b35269d37cd36fd2d630a2e7175eecec04ac3caf900c0a84b5b0377fb84dab93

    SHA512

    45535ad70f9237859d10b4f9e46862358845d5fd205b760a3f3c816875a8da442f3d8617d96f5181e26b7bccc6c029baa4987b404d8c337db42ea22bdc0e05cf

  • memory/2016-8-0x0000000002C30000-0x0000000002D30000-memory.dmp

    Filesize

    1024KB

  • memory/2016-9-0x00000000047F0000-0x000000000483B000-memory.dmp

    Filesize

    300KB

  • memory/2016-10-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2016-11-0x0000000000400000-0x0000000002BB1000-memory.dmp

    Filesize

    39.7MB

  • memory/2016-12-0x0000000007250000-0x0000000007296000-memory.dmp

    Filesize

    280KB

  • memory/2016-13-0x0000000007290000-0x0000000007834000-memory.dmp

    Filesize

    5.6MB

  • memory/2016-14-0x0000000007890000-0x00000000078D4000-memory.dmp

    Filesize

    272KB

  • memory/2016-60-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-70-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-78-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-76-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-74-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-72-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-68-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-66-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-64-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-62-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-58-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-56-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-54-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-52-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-50-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-48-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-46-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-44-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-42-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-40-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-38-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-36-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-34-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-32-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-30-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-28-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-26-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-24-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-22-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-20-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-18-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-16-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-15-0x0000000007890000-0x00000000078CF000-memory.dmp

    Filesize

    252KB

  • memory/2016-922-0x0000000002C30000-0x0000000002D30000-memory.dmp

    Filesize

    1024KB

  • memory/2016-923-0x0000000007930000-0x0000000007F48000-memory.dmp

    Filesize

    6.1MB

  • memory/2016-924-0x0000000007FD0000-0x00000000080DA000-memory.dmp

    Filesize

    1.0MB

  • memory/2016-925-0x00000000047F0000-0x000000000483B000-memory.dmp

    Filesize

    300KB

  • memory/2016-926-0x0000000008110000-0x0000000008122000-memory.dmp

    Filesize

    72KB

  • memory/2016-927-0x0000000008130000-0x000000000816C000-memory.dmp

    Filesize

    240KB

  • memory/2016-928-0x0000000008280000-0x00000000082CC000-memory.dmp

    Filesize

    304KB

  • memory/2016-929-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB