Analysis

  • max time kernel
    136s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 21:05

General

  • Target

    49f4ed88f2b0bebfb3e363ab5f0642df10d6a41bb2f220199ff855166218d862.exe

  • Size

    794KB

  • MD5

    dffa7d6b4708b40053421a6995eaf9be

  • SHA1

    b28f6eaed28c9c4ecd12e016e3108d4eb3f1357a

  • SHA256

    49f4ed88f2b0bebfb3e363ab5f0642df10d6a41bb2f220199ff855166218d862

  • SHA512

    7ac774dd19d59adabddc2c810698c9f1ddd141c4bb246da09f185a459404a28bd467626020e65ce1d36fbd2b09d7b32049da67fcf0ee810ed86062495b80c8a6

  • SSDEEP

    12288:ey90PemQKHqTrGp7BZnnZeXiR5wwB+Pm5InepXug6nPM5WGo1Iepa/hB:ey2RQ7TrKHn1R3B+u53pXCMLo1Iz/v

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49f4ed88f2b0bebfb3e363ab5f0642df10d6a41bb2f220199ff855166218d862.exe
    "C:\Users\Admin\AppData\Local\Temp\49f4ed88f2b0bebfb3e363ab5f0642df10d6a41bb2f220199ff855166218d862.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03220774.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03220774.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m00902875.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m00902875.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1472
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 1368
          4⤵
          • Program crash
          PID:760
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n48019991.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n48019991.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1756
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3616 -ip 3616
    1⤵
      PID:1564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x03220774.exe

      Filesize

      590KB

      MD5

      48fa781569319c6c451407a845d3c057

      SHA1

      cf940cd91c741284e1640f8f55e1c223e967c3b4

      SHA256

      aed7d7e49ede7bea27b7f75969cbe9e2482c8a11843dace7116b39eefc4c7655

      SHA512

      452763d15c3a5a966a176454e9136a6c5edc910715a9d60b262333301671742d91d600acfc765023b41197ff5413a1f1969c09e4d2bdd03d5bc273b63bba086b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m00902875.exe

      Filesize

      530KB

      MD5

      0c9c15709561c52e1e70e7ace418b1b4

      SHA1

      6a7fe0160636a4bcd19766c20504e2bcfb9f9702

      SHA256

      9b78fb739d8bfa7c946e860c2b58f4b277d1934bad61b191f889e8fcf0cdd522

      SHA512

      579e0ab5badd804ea0d3e312d01f26ebf36c3bd276adc6a0101c09da28e3a9950df4f10f7620ea94ce793301ef43116c0242a2f0e142ed79eae54c34fbfcff0c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n48019991.exe

      Filesize

      168KB

      MD5

      cadb85e3560bc711e4ddefa081ee2b8a

      SHA1

      78a50b5cc5f9c678891a068ed888b0d8cacfaaa5

      SHA256

      03477c0ce841fa1d7721453b29cc6e19afb8001d55303856ab72a7bec3d4798d

      SHA512

      85ee77e6026d5da91c814c313caa1b2d1079373b92d31fd93d03956812e9cc90c2f72b0820f6a2882c9ca6d8df75d06ad7c6ceb6ba75aaf3b7217983b69a1e9f

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1472-2182-0x0000000000530000-0x000000000055E000-memory.dmp

      Filesize

      184KB

    • memory/1472-2184-0x00000000054E0000-0x0000000005AF8000-memory.dmp

      Filesize

      6.1MB

    • memory/1472-2186-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

      Filesize

      72KB

    • memory/1472-2183-0x0000000000E70000-0x0000000000E76000-memory.dmp

      Filesize

      24KB

    • memory/1472-2188-0x0000000004F60000-0x0000000004FAC000-memory.dmp

      Filesize

      304KB

    • memory/1472-2187-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

      Filesize

      240KB

    • memory/1472-2185-0x0000000004FD0000-0x00000000050DA000-memory.dmp

      Filesize

      1.0MB

    • memory/1756-2197-0x0000000002E10000-0x0000000002E16000-memory.dmp

      Filesize

      24KB

    • memory/1756-2196-0x0000000000D60000-0x0000000000D90000-memory.dmp

      Filesize

      192KB

    • memory/3616-55-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-37-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-63-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-83-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-81-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-79-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-77-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-75-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-73-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-71-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-67-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-65-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-61-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-59-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-57-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-21-0x0000000005200000-0x0000000005266000-memory.dmp

      Filesize

      408KB

    • memory/3616-53-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-49-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-47-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-45-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-43-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-41-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-39-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-51-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-35-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-33-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-31-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-27-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-26-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-85-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-69-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-20-0x0000000005300000-0x00000000058A4000-memory.dmp

      Filesize

      5.6MB

    • memory/3616-19-0x0000000002D00000-0x0000000002D68000-memory.dmp

      Filesize

      416KB

    • memory/3616-18-0x0000000000400000-0x0000000000A95000-memory.dmp

      Filesize

      6.6MB

    • memory/3616-29-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-23-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-22-0x0000000005200000-0x0000000005260000-memory.dmp

      Filesize

      384KB

    • memory/3616-2169-0x00000000059D0000-0x0000000005A02000-memory.dmp

      Filesize

      200KB

    • memory/3616-2168-0x0000000000B10000-0x0000000000C10000-memory.dmp

      Filesize

      1024KB

    • memory/3616-2191-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3616-2190-0x0000000002750000-0x00000000027AB000-memory.dmp

      Filesize

      364KB

    • memory/3616-2192-0x0000000000400000-0x0000000000A95000-memory.dmp

      Filesize

      6.6MB

    • memory/3616-17-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3616-16-0x0000000002750000-0x00000000027AB000-memory.dmp

      Filesize

      364KB

    • memory/3616-15-0x0000000000B10000-0x0000000000C10000-memory.dmp

      Filesize

      1024KB