Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 05:36
Static task
static1
Behavioral task
behavioral1
Sample
5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe
Resource
win10v2004-20241007-en
General
-
Target
5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe
-
Size
774KB
-
MD5
497087d88b8b1c32496401f015d878fa
-
SHA1
86f50057063f09cb0b1e2a4988666b383a95e58d
-
SHA256
5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6
-
SHA512
ccc9479c964cf72a813a6ff202bedf82fdcd7dfe782435c62fa9a77dbdd647b00b3147ee82cb6bcd0513a8d854ea05919486e4d096c48023674015375a6e18ce
-
SSDEEP
12288:Yy90wwVR190lLemPNSvAHP/kOal4a7KvD8n7Nf6xvm5jCAhn:Yy+VF2LeoSoHJZDG7evU3hn
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/5088-2168-0x0000000005620000-0x0000000005652000-memory.dmp family_redline behavioral1/files/0x0002000000022a9f-2173.dat family_redline behavioral1/memory/5936-2185-0x0000000000510000-0x000000000053E000-memory.dmp family_redline behavioral1/files/0x0007000000023c9f-2187.dat family_redline behavioral1/memory/5712-2190-0x00000000005D0000-0x0000000000600000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation m16447610.exe -
Executes dropped EXE 4 IoCs
pid Process 896 x61915025.exe 5088 m16447610.exe 5936 1.exe 5712 n12961771.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x61915025.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language n12961771.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x61915025.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m16447610.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5088 m16447610.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3684 wrote to memory of 896 3684 5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe 83 PID 3684 wrote to memory of 896 3684 5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe 83 PID 3684 wrote to memory of 896 3684 5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe 83 PID 896 wrote to memory of 5088 896 x61915025.exe 85 PID 896 wrote to memory of 5088 896 x61915025.exe 85 PID 896 wrote to memory of 5088 896 x61915025.exe 85 PID 5088 wrote to memory of 5936 5088 m16447610.exe 88 PID 5088 wrote to memory of 5936 5088 m16447610.exe 88 PID 5088 wrote to memory of 5936 5088 m16447610.exe 88 PID 896 wrote to memory of 5712 896 x61915025.exe 89 PID 896 wrote to memory of 5712 896 x61915025.exe 89 PID 896 wrote to memory of 5712 896 x61915025.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe"C:\Users\Admin\AppData\Local\Temp\5427a5a2b54e283cc7aedb6bccaedcb9d5da6f6ed6d89f102528e01b27dd6df6.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x61915025.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x61915025.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m16447610.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m16447610.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5936
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n12961771.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n12961771.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5712
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570KB
MD5578047f002afeb35531fafc97798638a
SHA186651c3f32d6a860f54d56e843b79343908fd614
SHA25608ce8685f99fb61ede7d1e1198e7472c829a70d0822088d332bcdafccace56fa
SHA51251116326161bc5fd3e45229e0f36ab342dedff7d61e5f2820dde1d684ec5a9417a14b3324a655cb1cc675bedfb7580f06ea7ad3a878ff3c7d28f2685924ca8f6
-
Filesize
476KB
MD5dfa8fda29f7416337bf083ab7f5ccb6b
SHA1cda1bae78d230239c0b5421d637e4b5f3b8f05f6
SHA25637d9c1616784a6952397996175fdc4233881d4d52a999e2504bfabbddef97b2e
SHA512ad993e28a6f90a0144672976b854da5860422da7d6460d7cdbf765eca082b094d3c868d1ebaf3407555e91b5a9e4c8a6b66176019c6c01d885fc3be804b131c5
-
Filesize
169KB
MD5804947491737b8e07c231c4ffb2ad277
SHA13f8c3ae6f8d6303642574003f2ebc49ff4fa8840
SHA25685ea70364e886c3c2fc42a6568730075ca41b8193a030abda8171da9307c7364
SHA5124639f5960810908dce57c03524147ea31a2ca01deed434ebfed6e2604ea6cd6156fd6ed7123b6a12ccd544ac28123f59c0315368b350d4654608420d9e7b633e
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf