Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
Resource
win10v2004-20241007-en
General
-
Target
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
-
Size
770.0MB
-
MD5
a5a83474450554b7da04587cf77f76ec
-
SHA1
a8a579d8a66f4875df9cbed1a2a6c3392b232853
-
SHA256
b4781474596c183da5b10c22ce2260c802ef4f553ed347f4813ad30cab0d56e2
-
SHA512
db5c11cab72ccd89de9982c1dd5488e608195f795c5118f31160dab4a01c86d439ca9ddb37212647c38e0eac4d6394d3e47fe9c1e340f1f4cf95856e54624ee5
-
SSDEEP
12288:anAcUmI0cmsN0C1pXVnljw7zSrmP2LszN2lRjFoC8GJx5v:aY0mygdVlM7zSsWRSCv3R
Malware Config
Extracted
redline
word 7
65.21.74.139:20775
-
auth_value
fc283e807b7b9afa9b29c1b782aad551
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/5696-2855-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3792 set thread context of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 764 powershell.exe 764 powershell.exe 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe Token: SeDebugPrivilege 764 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3792 wrote to memory of 764 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 91 PID 3792 wrote to memory of 764 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 91 PID 3792 wrote to memory of 764 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 91 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95 PID 3792 wrote to memory of 5696 3792 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe"C:\Users\Admin\AppData\Local\Temp\a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- System Location Discovery: System Language Discovery
PID:5696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82