Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 11:00

General

  • Target

    be96ff083d5ae6dc3dd100ff70535bc963d221e0bd49a0372f31549d1aa23d68.exe

  • Size

    712KB

  • MD5

    a878864357901c3158dd9b65b9b1ecec

  • SHA1

    f8d7a94965d1455eebe94b99ab6c4915e4dca779

  • SHA256

    be96ff083d5ae6dc3dd100ff70535bc963d221e0bd49a0372f31549d1aa23d68

  • SHA512

    23a1f32b7c14dacc6845c8fa136b9a3ebac20064339b4ccfadf74799bc685a80e19300259e12ea2722e5867bc270036ea1f4998ddd795c74cb139f69e782a59a

  • SSDEEP

    12288:OMrBy90K9ArfPWipnhVlUu4m8qdl1zcgmvS2a338jHf50VEPK2V8CQH4PXSs:fyN9wdnhku4m/VRaNKu+YKs

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be96ff083d5ae6dc3dd100ff70535bc963d221e0bd49a0372f31549d1aa23d68.exe
    "C:\Users\Admin\AppData\Local\Temp\be96ff083d5ae6dc3dd100ff70535bc963d221e0bd49a0372f31549d1aa23d68.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0343731.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0343731.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6012870.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6012870.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3628

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0343731.exe

          Filesize

          420KB

          MD5

          05011e159b35eb2c42abfacc41995cba

          SHA1

          2143f86b1cdb9d85bbc4ba50d91a24a32641669f

          SHA256

          1bb050527197079ddfe7d8b2da15f7c95c4765081e85efd29bb77695220df79d

          SHA512

          0d35460da6f6c94d33582e2fd8272fec7d54470ce4cbcfb48f40130914145433754eff51259444ab2ac376c7cfb2d44523d005a1163344dbbc11653aa5bc8842

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6012870.exe

          Filesize

          136KB

          MD5

          900773e990d8b1e3af6e21f70254cfdb

          SHA1

          dda280ccdcfe908c9025e3ac2149ce85bdc21306

          SHA256

          be09a1ddcce79e01ba6501e664d631042f191e9bb1396cc4ae09df3343c1efc6

          SHA512

          bec9b05f0ae9fe0cc7bf1274963847adc4c2dbdb27cac3d86a96ee7472647383d6cb33a26a74ca2800c07248e1edec67cd2115d721bd13e5f9b820ae646b3e87

        • memory/3628-14-0x000000007432E000-0x000000007432F000-memory.dmp

          Filesize

          4KB

        • memory/3628-15-0x0000000000920000-0x0000000000948000-memory.dmp

          Filesize

          160KB

        • memory/3628-16-0x0000000007BD0000-0x00000000081E8000-memory.dmp

          Filesize

          6.1MB

        • memory/3628-17-0x0000000007640000-0x0000000007652000-memory.dmp

          Filesize

          72KB

        • memory/3628-18-0x00000000077B0000-0x00000000078BA000-memory.dmp

          Filesize

          1.0MB

        • memory/3628-19-0x00000000076E0000-0x000000000771C000-memory.dmp

          Filesize

          240KB

        • memory/3628-20-0x0000000074320000-0x0000000074AD0000-memory.dmp

          Filesize

          7.7MB

        • memory/3628-21-0x0000000002AF0000-0x0000000002B3C000-memory.dmp

          Filesize

          304KB

        • memory/3628-22-0x000000007432E000-0x000000007432F000-memory.dmp

          Filesize

          4KB

        • memory/3628-23-0x0000000074320000-0x0000000074AD0000-memory.dmp

          Filesize

          7.7MB