Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe
Resource
win10v2004-20241007-en
General
-
Target
c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe
-
Size
786KB
-
MD5
fa4d86ba6412cd769fddbb26d9ff0094
-
SHA1
9ff8bfb1cf8693ceeb77b21340d6ede30c0ebc06
-
SHA256
c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a
-
SHA512
44b8bbbf32424d4d1d293f942e52785c84c260e6b7792981f4d4047c5d87dfe31f9e7eca4e8dc080a6365c8599733d12544bb62b4c9cc6c2a47f4710fd3040aa
-
SSDEEP
12288:my90KWiq7CFO1GLdaO4cKzHttVBi2RS72buZEK6IKVrjNQDt3MhzEolu5dGE+/:myhq7C01S7JQRSquZ76jrZQJ31VvL+/
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/4780-2168-0x0000000002AB0000-0x0000000002AE2000-memory.dmp family_redline behavioral1/files/0x0002000000022dc9-2173.dat family_redline behavioral1/memory/4800-2181-0x00000000007B0000-0x00000000007DE000-memory.dmp family_redline behavioral1/files/0x000a000000023b8d-2193.dat family_redline behavioral1/memory/1116-2195-0x0000000000C70000-0x0000000000CA0000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation m07084837.exe -
Executes dropped EXE 4 IoCs
pid Process 4624 x80655211.exe 4780 m07084837.exe 4800 1.exe 1116 n26492810.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x80655211.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5052 4780 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x80655211.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m07084837.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language n26492810.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4780 m07084837.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2772 wrote to memory of 4624 2772 c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe 83 PID 2772 wrote to memory of 4624 2772 c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe 83 PID 2772 wrote to memory of 4624 2772 c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe 83 PID 4624 wrote to memory of 4780 4624 x80655211.exe 84 PID 4624 wrote to memory of 4780 4624 x80655211.exe 84 PID 4624 wrote to memory of 4780 4624 x80655211.exe 84 PID 4780 wrote to memory of 4800 4780 m07084837.exe 88 PID 4780 wrote to memory of 4800 4780 m07084837.exe 88 PID 4780 wrote to memory of 4800 4780 m07084837.exe 88 PID 4624 wrote to memory of 1116 4624 x80655211.exe 94 PID 4624 wrote to memory of 1116 4624 x80655211.exe 94 PID 4624 wrote to memory of 1116 4624 x80655211.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe"C:\Users\Admin\AppData\Local\Temp\c479bcc9615b2966c37a61a0504469a9658a16dd909fb182f69ef77d6334291a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x80655211.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x80655211.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m07084837.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m07084837.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 15084⤵
- Program crash
PID:5052
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n26492810.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n26492810.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4780 -ip 47801⤵PID:644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
581KB
MD56dfe1231da58f0fdb3561177112be9ab
SHA16ed3b2d724a3613896f70172f42f5a0307744b2f
SHA2564b2d497f58321eb8ba5bc2154e7397e0d66b71ed24b0bc6927663119ab8a7843
SHA512fbe509fae299813477cc7023bdb42817d769c60124a9350f53a273e6316d04cbedcadcb2114dfad266da12a84fe3c15486c3dde31bd67a372287d3c2d5cccb47
-
Filesize
580KB
MD5f8af3f186c90d71929e49f63febe9d68
SHA16c378153a3c1793e6307e10f98045b9e4c92aa8d
SHA256596cb5b27f72a102ba38c188c49ea546f29c4742a04ea8f19075cd00d99a6e3b
SHA512ec6a6e1d070d1c7d612e310574c32c3d26aaa7ab7d21f8f63e616de3a341183c3ae8efb4ac9f9cf0d9192fe59086c98b3a0c65924006421e844baba1ec8910cb
-
Filesize
171KB
MD51206eed93fa2b4f7e83c142517d643bb
SHA14138d948681e2e0105c9b44e062ba364557929b1
SHA25666541cf0cc77d26d1cb8f188ebf250b9977f8ca07704cff7965ca97eae19c6ea
SHA512516656813054825c1d123c0a40b3c93f6a2490611c909ec61da6d7294321a09e548ec5afe6359c5ed6dfa8ac7dfa58677d77617605582e034d4c45d63a1e34a5
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf