Analysis

  • max time kernel
    131s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 10:22

General

  • Target

    setup.exe

  • Size

    600KB

  • MD5

    52be306b77fc18e2db2ad3ec7d08f008

  • SHA1

    4d75fe2be99acd65d3276be87f553aa54457d38c

  • SHA256

    0597ad3f1805bbfaf14910f21aa830c489ec9fe2876407e3cbb24f60b364acd4

  • SHA512

    7b2d464c1fd823f0fb65d28ebb9d2d660af3d55e14eb5bb21672be558d6ddd5ba2efba20a1eb0832a7b179cac8376972552bee831dc621e9a02b19b6fc1b9177

  • SSDEEP

    12288:9zpAD4jTzVbgoJ6k/P2RNlZGzQS03ULaHNqrxlKIQNoxcd/BlZk8gKt:9Vq47VbXZ/ORvZGzkEaHNYK3Mcd5lgu

Malware Config

Extracted

Family

redline

Botnet

@dxpex

C2

185.11.73.34:18717

Attributes
  • auth_value

    7d71dc2486a2f78d8097fa5a22e9ed30

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2040

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1460-6-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/1460-24-0x0000000000400000-0x000000000056A000-memory.dmp

          Filesize

          1.4MB

        • memory/1460-9-0x0000000003200000-0x0000000003300000-memory.dmp

          Filesize

          1024KB

        • memory/1460-17-0x0000000000660000-0x0000000000661000-memory.dmp

          Filesize

          4KB

        • memory/1460-16-0x0000000003220000-0x0000000003221000-memory.dmp

          Filesize

          4KB

        • memory/1460-15-0x0000000003230000-0x0000000003231000-memory.dmp

          Filesize

          4KB

        • memory/1460-14-0x0000000003240000-0x0000000003241000-memory.dmp

          Filesize

          4KB

        • memory/1460-13-0x0000000000650000-0x0000000000651000-memory.dmp

          Filesize

          4KB

        • memory/1460-12-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/1460-11-0x0000000003200000-0x0000000003204000-memory.dmp

          Filesize

          16KB

        • memory/1460-8-0x0000000003200000-0x0000000003300000-memory.dmp

          Filesize

          1024KB

        • memory/1460-7-0x0000000002360000-0x0000000002361000-memory.dmp

          Filesize

          4KB

        • memory/1460-1-0x0000000000730000-0x0000000000790000-memory.dmp

          Filesize

          384KB

        • memory/1460-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

          Filesize

          4KB

        • memory/1460-25-0x0000000000730000-0x0000000000790000-memory.dmp

          Filesize

          384KB

        • memory/1460-3-0x0000000002320000-0x0000000002321000-memory.dmp

          Filesize

          4KB

        • memory/1460-2-0x0000000002310000-0x0000000002311000-memory.dmp

          Filesize

          4KB

        • memory/1460-10-0x0000000003210000-0x0000000003211000-memory.dmp

          Filesize

          4KB

        • memory/1460-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

          Filesize

          4KB

        • memory/1460-0-0x0000000000400000-0x000000000056A000-memory.dmp

          Filesize

          1.4MB

        • memory/2040-19-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/2040-26-0x0000000005D30000-0x0000000006348000-memory.dmp

          Filesize

          6.1MB

        • memory/2040-27-0x00000000075D0000-0x00000000075E2000-memory.dmp

          Filesize

          72KB

        • memory/2040-28-0x0000000005870000-0x000000000597A000-memory.dmp

          Filesize

          1.0MB

        • memory/2040-29-0x00000000057B0000-0x00000000057EC000-memory.dmp

          Filesize

          240KB

        • memory/2040-30-0x00000000057F0000-0x000000000583C000-memory.dmp

          Filesize

          304KB