Analysis

  • max time kernel
    132s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 22:20

General

  • Target

    5e8eec1d25e26047f0748aa13b1f25bc2cc6828367593c403420de3f4089e12fN.exe

  • Size

    843KB

  • MD5

    0060f21d8002518dc669236b5c2692b0

  • SHA1

    cef3ed70fd8fb76cee25db7078bbd05945317df1

  • SHA256

    5e8eec1d25e26047f0748aa13b1f25bc2cc6828367593c403420de3f4089e12f

  • SHA512

    890b18b5fec6b7dcc86bd99b7dce56691580fd28cc11c62aa0fe9f48c857ea2ade0ba7de6acda807d9780a811d2096c9a1757e85f19287c0e8043a97537bbb50

  • SSDEEP

    24576:HyK3O3oVgzCcpr1/LVHUSoKqS7/l+Kf7:SK3OCgzCczVUS3dth

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e8eec1d25e26047f0748aa13b1f25bc2cc6828367593c403420de3f4089e12fN.exe
    "C:\Users\Admin\AppData\Local\Temp\5e8eec1d25e26047f0748aa13b1f25bc2cc6828367593c403420de3f4089e12fN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i88034347.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i88034347.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4752
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a76258075.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a76258075.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i88034347.exe

    Filesize

    371KB

    MD5

    7b45c3bbefc65d092f9ff72d76e87b01

    SHA1

    83e5616cd32629b164cccf68e722e8635c54b42a

    SHA256

    68fc27a8dff40abc5216d2bb14cf5d83ce71683657b6bf111abf5e89220d8123

    SHA512

    2a668c045d6c06f2182aefa0947756e6eae83e34d65a7399867a8c263f571537b1b5bbe65b6931ec1606d09b692875c664de452dddccd132cf438f6d6612c8a2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a76258075.exe

    Filesize

    169KB

    MD5

    b982398e2ce0cf8b607286083bc71c47

    SHA1

    9bc0dc9f894efae29aa13c7dc8620acd65eb2912

    SHA256

    12132f821daef3ccf262499529e908f7ca2aa461ba39d3d9f84e0c54846c2d60

    SHA512

    a6a998e3f5ee48e58fa0d4fa59da8557cf140ef5b8d126ab6ce3b176f89f5d49284a8686ffadc24374d576d601dc012ece2421685cd66cc74e04c80594fbf754

  • memory/4680-14-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

    Filesize

    4KB

  • memory/4680-15-0x0000000000130000-0x0000000000160000-memory.dmp

    Filesize

    192KB

  • memory/4680-16-0x0000000002420000-0x0000000002426000-memory.dmp

    Filesize

    24KB

  • memory/4680-17-0x000000000A480000-0x000000000AA98000-memory.dmp

    Filesize

    6.1MB

  • memory/4680-18-0x0000000009FA0000-0x000000000A0AA000-memory.dmp

    Filesize

    1.0MB

  • memory/4680-19-0x0000000009ED0000-0x0000000009EE2000-memory.dmp

    Filesize

    72KB

  • memory/4680-20-0x0000000009F30000-0x0000000009F6C000-memory.dmp

    Filesize

    240KB

  • memory/4680-21-0x0000000073F80000-0x0000000074730000-memory.dmp

    Filesize

    7.7MB

  • memory/4680-22-0x0000000004460000-0x00000000044AC000-memory.dmp

    Filesize

    304KB

  • memory/4680-23-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

    Filesize

    4KB

  • memory/4680-24-0x0000000073F80000-0x0000000074730000-memory.dmp

    Filesize

    7.7MB