Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:37

General

  • Target

    cecb0cde272847011dd2403f79e5cf2ab07b49f2b65d49ef5d00ffd9bb6a66e2.exe

  • Size

    1.4MB

  • MD5

    1fa20ce685ec4c6644d7319fe54e161e

  • SHA1

    43de7be6340ca27514e199c16935a7c8a3503536

  • SHA256

    cecb0cde272847011dd2403f79e5cf2ab07b49f2b65d49ef5d00ffd9bb6a66e2

  • SHA512

    204b4131bfd9a2bb24da06c84fb2e63aca50cc4c5dfba7ec34407ae76a17f194018f5b2d1d1f4be2c8afac962c085160728f888d7a38d138d6c9a0d579cab545

  • SSDEEP

    24576:QyS7ch9MT7w6RiAfa1IFTkycjrQ6lksOw295b7QYZGpew3a1jagTE718/pC:XMcLy7w68sTjY2HZy585TE7G/p

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cecb0cde272847011dd2403f79e5cf2ab07b49f2b65d49ef5d00ffd9bb6a66e2.exe
    "C:\Users\Admin\AppData\Local\Temp\cecb0cde272847011dd2403f79e5cf2ab07b49f2b65d49ef5d00ffd9bb6a66e2.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i31597883.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i31597883.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36009917.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36009917.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i22580956.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i22580956.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3608
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i67693533.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i67693533.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78241290.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78241290.exe
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i31597883.exe

    Filesize

    1.2MB

    MD5

    daab354c721fafd2ee243a05767c7468

    SHA1

    7f26ce46e73732f540a4269ac032c13cc99c8fae

    SHA256

    2da87139d7e667973f378d79d15e5699b408a8eb0db3ec5b067df58ef08c9c27

    SHA512

    fe2c8fd05ae113bae76c6acf5deb579fe4e1c060a9e9dffb871d526e0e09fc869ae4059bf6442097f9ee585995110b0f5c81de0cd060420d7f9cbfc657202de5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i36009917.exe

    Filesize

    1018KB

    MD5

    3a891891b1a5cad57b3989e090bf7a45

    SHA1

    23300df99171a8b3eccd3076d243eb928405b83b

    SHA256

    e05723334c15901fc9c49ec8fd360caafcfcac948b67f811dc0047f936a9ce70

    SHA512

    188d1d48fcbbd801781402822311af210e89b3dc9c0578d409b3c0655ca9081a2e5753cb3847919bb4b87cc916517b09a547502ab13e9a048eb371e0f752c930

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i22580956.exe

    Filesize

    846KB

    MD5

    15afed7ad4a63230f5889cd16befcfcb

    SHA1

    2fc0406edb137d816ef78add3f1122405ab4a8e2

    SHA256

    3c406e69fe367ff17c3696ec00a295a9dbb2aa0b1d8a7a9fb935dd59761c43c3

    SHA512

    efc7fb2e2529a6be251b2e3b5cbd44d51d7fbe1297bcbb3c28e1979a0a33769ea4e74e2c008c71bebcf0bd10cafbf2b34953b7ed3d446d8e858db5f15958c481

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i67693533.exe

    Filesize

    374KB

    MD5

    50e64249ab3e5c4357c0aa5b959486dd

    SHA1

    4dfc80849cdeaa991cfbaea1676d50116e49a78b

    SHA256

    dd2b61f7abbee9a2dd29f96d4a8beaf4e61839551745361e0eb5de342eafb923

    SHA512

    94611819189da460069e271dea11cfdc7998cb7ccc1ba74f79fad965ed30b5e3897a117a8c12a9d25b71b467b9e4ba7e7d59a961b357d8a0221d8d6b058cf2d0

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a78241290.exe

    Filesize

    169KB

    MD5

    e0a5330d1d105090f672424393566336

    SHA1

    3d00706858bcf31b8e7c796423e8ece447a49d03

    SHA256

    57d9202819648c6f2dec5ef6d39c678d2377e9daa06c85fa0cfc693258c141b0

    SHA512

    6436bf0241555ca37c82059b63417e4bafee4b75fc147302cf45e862913f665e61800f8c457715889922d3f06ac952c26340ba1b58a613cb727da10aaaabc988

  • memory/552-35-0x0000000000EF0000-0x0000000000F20000-memory.dmp

    Filesize

    192KB

  • memory/552-36-0x0000000003110000-0x0000000003116000-memory.dmp

    Filesize

    24KB

  • memory/552-37-0x0000000005E90000-0x00000000064A8000-memory.dmp

    Filesize

    6.1MB

  • memory/552-38-0x0000000005980000-0x0000000005A8A000-memory.dmp

    Filesize

    1.0MB

  • memory/552-39-0x0000000005870000-0x0000000005882000-memory.dmp

    Filesize

    72KB

  • memory/552-40-0x00000000058D0000-0x000000000590C000-memory.dmp

    Filesize

    240KB

  • memory/552-41-0x0000000005920000-0x000000000596C000-memory.dmp

    Filesize

    304KB