Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 22:20

General

  • Target

    48f20912518df567aaf4d979d318444b8030a580cb700d88f26f1c23542bb621.exe

  • Size

    440KB

  • MD5

    4dfef2d62ab4de99344a8cd41f54faf9

  • SHA1

    c65a06802bedc264b5dd1b52aa4e852045cf6adb

  • SHA256

    48f20912518df567aaf4d979d318444b8030a580cb700d88f26f1c23542bb621

  • SHA512

    dcccd5856ccfa9ebbed55a9f7c346b3b2bc3e3d4a11e2ea9a3615fcee521a36be33fdd32bef9732538c7d96bb4beca36a83b42af3bea00caabeb87bb71fbedfa

  • SSDEEP

    6144:Kay+bnr+Ip0yN90QEl91F97Cs5+bnIWqvUWcTVsAdRw6foqbrmFPrTOgw1HcgyxO:OMrEy90v91LCs5+bIWdzVsAd+6wrTO5

Malware Config

Extracted

Family

redline

Botnet

ramon

C2

193.233.20.23:4123

Attributes
  • auth_value

    3197576965d9513f115338c233015b40

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48f20912518df567aaf4d979d318444b8030a580cb700d88f26f1c23542bb621.exe
    "C:\Users\Admin\AppData\Local\Temp\48f20912518df567aaf4d979d318444b8030a580cb700d88f26f1c23542bb621.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wKq28jb65.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wKq28jb65.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wKq28jb65.exe

    Filesize

    374KB

    MD5

    dc87fc747ed14e7e07d222a946edf7c3

    SHA1

    bfaa2e559fdd8e0db71da8e30d9ff52a74f04b8a

    SHA256

    ac04ebd907b3f394e6ebd788df9cf663853d22961d2259a3da243ada170869a1

    SHA512

    0df4a616be289551060f940880c595c05fdd4d9366796770a4a345e3fdcd4bc299efd2f6c5fe9f6bda6f4ec2b3247d0ecbdf2ab1f5c150ed6a986c2b775bc733

  • memory/2240-8-0x0000000002FB0000-0x00000000030B0000-memory.dmp

    Filesize

    1024KB

  • memory/2240-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2240-10-0x0000000004D20000-0x0000000004D66000-memory.dmp

    Filesize

    280KB

  • memory/2240-11-0x0000000007260000-0x0000000007804000-memory.dmp

    Filesize

    5.6MB

  • memory/2240-13-0x0000000000400000-0x0000000002BCA000-memory.dmp

    Filesize

    39.8MB

  • memory/2240-12-0x0000000007810000-0x0000000007854000-memory.dmp

    Filesize

    272KB

  • memory/2240-43-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-73-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-77-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-75-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-71-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-69-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-67-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-65-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-63-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-61-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-59-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-57-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-55-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-53-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-51-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-49-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-47-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-45-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-41-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-39-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-37-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-35-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-33-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-31-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-29-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-25-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-23-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-21-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-19-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-17-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-15-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-14-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-27-0x0000000007810000-0x000000000784E000-memory.dmp

    Filesize

    248KB

  • memory/2240-886-0x0000000000400000-0x0000000002BCA000-memory.dmp

    Filesize

    39.8MB

  • memory/2240-922-0x0000000007EB0000-0x0000000007FBA000-memory.dmp

    Filesize

    1.0MB

  • memory/2240-921-0x0000000007850000-0x0000000007E68000-memory.dmp

    Filesize

    6.1MB

  • memory/2240-923-0x0000000007FE0000-0x0000000007FF2000-memory.dmp

    Filesize

    72KB

  • memory/2240-924-0x0000000008000000-0x000000000803C000-memory.dmp

    Filesize

    240KB

  • memory/2240-925-0x0000000008150000-0x000000000819C000-memory.dmp

    Filesize

    304KB

  • memory/2240-927-0x0000000002FB0000-0x00000000030B0000-memory.dmp

    Filesize

    1024KB

  • memory/2240-928-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB