Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 04:00

General

  • Target

    9dbec3c5fc412423ed0c9f7107d902b146111387c803f154324fba4d2a7dfa17.exe

  • Size

    434KB

  • MD5

    c39f2a53e6188c1ceb086ca7d349f44f

  • SHA1

    df2cb2ba3b579063bc71497fb844366ae7b08885

  • SHA256

    9dbec3c5fc412423ed0c9f7107d902b146111387c803f154324fba4d2a7dfa17

  • SHA512

    b771307e20eb9255b8e2367b12efe17c045d474b21fb1c2c67d4448e410f97cab2399eb9e4f9c2825dd7a0455a08d23ed74c9b13075fa4abef3ebef5bb1ae2ae

  • SSDEEP

    6144:K/y+bnr+Fp0yN90QE2kpPP5sL+lpt/jJeYArEL+Gc8c7P2fgcXIWtcZW:FMrNy901l59lXYjpn8cr2fbvtaW

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9dbec3c5fc412423ed0c9f7107d902b146111387c803f154324fba4d2a7dfa17.exe
    "C:\Users\Admin\AppData\Local\Temp\9dbec3c5fc412423ed0c9f7107d902b146111387c803f154324fba4d2a7dfa17.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esG81KB20.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esG81KB20.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\esG81KB20.exe

    Filesize

    316KB

    MD5

    5a4ff96d0686fbf07f65e4fb559c3142

    SHA1

    a5605cc33f133613507d0417a24e0849a0a7792a

    SHA256

    936572d2ce48bdaab44b98e18e0a34caad9fd438f7b5c1a1fb27e658bdb4e8ae

    SHA512

    2dbde50807b566ec2c0c3ba8f47232e63e1f0dae31c462bc7365f3a0c3681df91b733ffb5ce32bc06cb43e8f9e666a421d59b0481aca07f86e93b8a386775580

  • memory/1988-8-0x0000000004BD0000-0x0000000004C16000-memory.dmp

    Filesize

    280KB

  • memory/1988-9-0x0000000007220000-0x00000000077C4000-memory.dmp

    Filesize

    5.6MB

  • memory/1988-11-0x0000000000400000-0x0000000002BA8000-memory.dmp

    Filesize

    39.7MB

  • memory/1988-10-0x0000000004D70000-0x0000000004DB4000-memory.dmp

    Filesize

    272KB

  • memory/1988-61-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-75-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-73-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-71-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-69-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-207-0x0000000000400000-0x0000000002BA8000-memory.dmp

    Filesize

    39.7MB

  • memory/1988-67-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-65-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-63-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-57-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-55-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-53-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-49-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-47-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-45-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-43-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-39-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-35-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-33-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-31-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-29-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-27-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-25-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-23-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-21-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-19-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-17-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-15-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-13-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-59-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-51-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-41-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-37-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-12-0x0000000004D70000-0x0000000004DAF000-memory.dmp

    Filesize

    252KB

  • memory/1988-919-0x00000000077E0000-0x0000000007DF8000-memory.dmp

    Filesize

    6.1MB

  • memory/1988-920-0x0000000007E80000-0x0000000007F8A000-memory.dmp

    Filesize

    1.0MB

  • memory/1988-921-0x0000000007FC0000-0x0000000007FD2000-memory.dmp

    Filesize

    72KB

  • memory/1988-922-0x0000000007FE0000-0x000000000801C000-memory.dmp

    Filesize

    240KB

  • memory/1988-923-0x0000000008130000-0x000000000817C000-memory.dmp

    Filesize

    304KB