Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 06:07

General

  • Target

    ed5d368fabba2fa0b39795e4b10060abb769a82b18e9d3cfe1e60cbf2b049433.exe

  • Size

    769KB

  • MD5

    de69bf212c6b8072e8c35a520e6bd058

  • SHA1

    a44da60a032e14949cf223cb81c6627c38a7861f

  • SHA256

    ed5d368fabba2fa0b39795e4b10060abb769a82b18e9d3cfe1e60cbf2b049433

  • SHA512

    1e6b1ffc7dc7e4737d3b42df6baca0b3279061f32b2c21cfb3a675185957ba6a544583d48cee490af4970c165c118660689e4766c48d0b605041444ca835c245

  • SSDEEP

    12288:IMrSy90T6+uAc/1q23VPUf+rGiHnCwKZQpYHrXQuAUCjvd0Ml7EWVB:6yKc/1qGVsfaPKAiXQuGj10M1XVB

Malware Config

Extracted

Family

redline

Botnet

mixa

C2

185.161.248.75:4132

Attributes
  • auth_value

    9d14534b25ac495ab25b59800acf3bb2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed5d368fabba2fa0b39795e4b10060abb769a82b18e9d3cfe1e60cbf2b049433.exe
    "C:\Users\Admin\AppData\Local\Temp\ed5d368fabba2fa0b39795e4b10060abb769a82b18e9d3cfe1e60cbf2b049433.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2160758.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2160758.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6797957.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6797957.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3203669.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3203669.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8056859.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8056859.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1244

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2160758.exe

          Filesize

          488KB

          MD5

          2404543ad290271e72a299cfe20b61d1

          SHA1

          a8d190b79f77b6d749b7281e6dab287eb1bc129c

          SHA256

          ba74069e8c275aaf4a5c28b190a650427bb8647b53b25b63ab8c11d457952261

          SHA512

          b2d1ad12c7bae5ab21a1db92d27656e86acdaab02e474637bad9dde523883e015562ffb05dd5ad26d1a5d0f49020e7a0c4137487e061963c98e27f77a9ff12ba

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6797957.exe

          Filesize

          316KB

          MD5

          b06515d5ce860c163c7f6f144b7183d9

          SHA1

          d061d7f1154c9bd20325b23055714997613d903f

          SHA256

          ff552cc83e93e41497b3cf171b80333a81a13fcf13c40af9ac1dc4154cee8f95

          SHA512

          45056bfc8128c12c4804d064d57f53f01bf586bad1b3956bf8f83803e0d6b85e2a33bc98e5a2f5ef85326b032149a6485daec490ae5722c668e1da4cd1dbe192

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3203669.exe

          Filesize

          184KB

          MD5

          d4c640fb500618ad6c9fc5fe7d3e784d

          SHA1

          850df0880e1685ce709b44afbbb365cab4f0fec4

          SHA256

          a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b

          SHA512

          a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8056859.exe

          Filesize

          168KB

          MD5

          9307174dfb6edd81b2e625eac0e60bd3

          SHA1

          777d7e309e65ce9ed4f0169f3842a46ef7295c60

          SHA256

          61c74ce4a92b2b33773e234fac3d58b3af1443d64dd623b444a15c30e80136e2

          SHA512

          c0eefeb8ef626fd02fcd388d11cf4f3487f94e6df9780d450bd3fa28a628687f787f7bbb356e035b17bf8f067a917e2e52d41400079a911dff065d5785cd72e5

        • memory/1244-62-0x00000000058F0000-0x000000000593C000-memory.dmp

          Filesize

          304KB

        • memory/1244-61-0x0000000005770000-0x00000000057AC000-memory.dmp

          Filesize

          240KB

        • memory/1244-60-0x0000000005710000-0x0000000005722000-memory.dmp

          Filesize

          72KB

        • memory/1244-59-0x00000000057E0000-0x00000000058EA000-memory.dmp

          Filesize

          1.0MB

        • memory/1244-58-0x0000000005C90000-0x00000000062A8000-memory.dmp

          Filesize

          6.1MB

        • memory/1244-57-0x0000000001410000-0x0000000001416000-memory.dmp

          Filesize

          24KB

        • memory/1244-56-0x0000000000C50000-0x0000000000C7E000-memory.dmp

          Filesize

          184KB

        • memory/1748-49-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-24-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-37-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-35-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-33-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-31-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-29-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-27-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-25-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-39-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-41-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-43-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-45-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-47-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-51-0x0000000004A60000-0x0000000004A76000-memory.dmp

          Filesize

          88KB

        • memory/1748-23-0x0000000004A60000-0x0000000004A7C000-memory.dmp

          Filesize

          112KB

        • memory/1748-22-0x0000000004AE0000-0x0000000005084000-memory.dmp

          Filesize

          5.6MB

        • memory/1748-21-0x0000000002310000-0x000000000232E000-memory.dmp

          Filesize

          120KB