Analysis

  • max time kernel
    137s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 22:22

General

  • Target

    c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe

  • Size

    786KB

  • MD5

    fa4d86ba6412cd769fddbb26d9ff0094

  • SHA1

    9ff8bfb1cf8693ceeb77b21340d6ede30c0ebc06

  • SHA256

    c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a

  • SHA512

    44b8bbbf32424d4d1d293f942e52785c84c260e6b7792981f4d4047c5d87dfe31f9e7eca4e8dc080a6365c8599733d12544bb62b4c9cc6c2a47f4710fd3040aa

  • SSDEEP

    12288:my90KWiq7CFO1GLdaO4cKzHttVBi2RS72buZEK6IKVrjNQDt3MhzEolu5dGE+/:myhq7C01S7JQRSquZ76jrZQJ31VvL+/

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe
    "C:\Users\Admin\AppData\Local\Temp\c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x80655211.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x80655211.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m07084837.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m07084837.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4800
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1508
          4⤵
          • Program crash
          PID:5052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n26492810.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n26492810.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4780 -ip 4780
    1⤵
      PID:644

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x80655211.exe

      Filesize

      581KB

      MD5

      6dfe1231da58f0fdb3561177112be9ab

      SHA1

      6ed3b2d724a3613896f70172f42f5a0307744b2f

      SHA256

      4b2d497f58321eb8ba5bc2154e7397e0d66b71ed24b0bc6927663119ab8a7843

      SHA512

      fbe509fae299813477cc7023bdb42817d769c60124a9350f53a273e6316d04cbedcadcb2114dfad266da12a84fe3c15486c3dde31bd67a372287d3c2d5cccb47

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m07084837.exe

      Filesize

      580KB

      MD5

      f8af3f186c90d71929e49f63febe9d68

      SHA1

      6c378153a3c1793e6307e10f98045b9e4c92aa8d

      SHA256

      596cb5b27f72a102ba38c188c49ea546f29c4742a04ea8f19075cd00d99a6e3b

      SHA512

      ec6a6e1d070d1c7d612e310574c32c3d26aaa7ab7d21f8f63e616de3a341183c3ae8efb4ac9f9cf0d9192fe59086c98b3a0c65924006421e844baba1ec8910cb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n26492810.exe

      Filesize

      171KB

      MD5

      1206eed93fa2b4f7e83c142517d643bb

      SHA1

      4138d948681e2e0105c9b44e062ba364557929b1

      SHA256

      66541cf0cc77d26d1cb8f188ebf250b9977f8ca07704cff7965ca97eae19c6ea

      SHA512

      516656813054825c1d123c0a40b3c93f6a2490611c909ec61da6d7294321a09e548ec5afe6359c5ed6dfa8ac7dfa58677d77617605582e034d4c45d63a1e34a5

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1116-2196-0x0000000001350000-0x0000000001356000-memory.dmp

      Filesize

      24KB

    • memory/1116-2195-0x0000000000C70000-0x0000000000CA0000-memory.dmp

      Filesize

      192KB

    • memory/4780-51-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-22-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-21-0x00000000028C0000-0x0000000002926000-memory.dmp

      Filesize

      408KB

    • memory/4780-57-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-37-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-32-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-65-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-85-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-83-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-81-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-79-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-77-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-75-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-73-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-71-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-69-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-67-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-63-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-61-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-59-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-55-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-53-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-19-0x0000000002850000-0x00000000028B8000-memory.dmp

      Filesize

      416KB

    • memory/4780-49-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-20-0x0000000005170000-0x0000000005714000-memory.dmp

      Filesize

      5.6MB

    • memory/4780-15-0x0000000000B10000-0x0000000000C10000-memory.dmp

      Filesize

      1024KB

    • memory/4780-47-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-41-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-39-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-35-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-34-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-29-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-27-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-25-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-23-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-43-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4780-2168-0x0000000002AB0000-0x0000000002AE2000-memory.dmp

      Filesize

      200KB

    • memory/4780-18-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4780-16-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/4780-17-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4780-2183-0x0000000000B10000-0x0000000000C10000-memory.dmp

      Filesize

      1024KB

    • memory/4780-2191-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/4780-2190-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4780-45-0x00000000028C0000-0x0000000002920000-memory.dmp

      Filesize

      384KB

    • memory/4800-2186-0x0000000005120000-0x0000000005132000-memory.dmp

      Filesize

      72KB

    • memory/4800-2188-0x0000000005300000-0x000000000534C000-memory.dmp

      Filesize

      304KB

    • memory/4800-2185-0x00000000051F0000-0x00000000052FA000-memory.dmp

      Filesize

      1.0MB

    • memory/4800-2184-0x00000000056C0000-0x0000000005CD8000-memory.dmp

      Filesize

      6.1MB

    • memory/4800-2182-0x0000000004F40000-0x0000000004F46000-memory.dmp

      Filesize

      24KB

    • memory/4800-2181-0x00000000007B0000-0x00000000007DE000-memory.dmp

      Filesize

      184KB

    • memory/4800-2187-0x0000000005180000-0x00000000051BC000-memory.dmp

      Filesize

      240KB