Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe
Resource
win10v2004-20241007-en
General
-
Target
6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe
-
Size
793KB
-
MD5
7c95c7d49f4d5b1d97ab09e2336fce72
-
SHA1
82fb64fecca045b38bee29c340f674338e90e983
-
SHA256
6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8
-
SHA512
ffc28bc309b71c95527db166149dd29a160040ddcb402733124987024d212e999bcd68f7abc0c4012e2c2f04284015ffb66e0c883345b1b7a5ecef56fc21eec9
-
SSDEEP
12288:qy90FvgBt+2dfZ9GeYTW3QaTSUNAFBYsTGU56p3peBQ6zJ6iVbOZG0VfoTbXS:qyug7XdfeSQUOp7zJ6iVbP0VfoTLS
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/4844-2169-0x0000000005B00000-0x0000000005B32000-memory.dmp family_redline behavioral1/files/0x0002000000022b11-2174.dat family_redline behavioral1/memory/5524-2182-0x0000000000D20000-0x0000000000D4E000-memory.dmp family_redline behavioral1/files/0x000b000000023bae-2194.dat family_redline behavioral1/memory/2980-2196-0x00000000004F0000-0x0000000000520000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation m53997876.exe -
Executes dropped EXE 4 IoCs
pid Process 4404 x71553491.exe 4844 m53997876.exe 5524 1.exe 2980 n33694289.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x71553491.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5924 4844 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x71553491.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m53997876.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language n33694289.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4844 m53997876.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4404 4716 6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe 83 PID 4716 wrote to memory of 4404 4716 6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe 83 PID 4716 wrote to memory of 4404 4716 6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe 83 PID 4404 wrote to memory of 4844 4404 x71553491.exe 84 PID 4404 wrote to memory of 4844 4404 x71553491.exe 84 PID 4404 wrote to memory of 4844 4404 x71553491.exe 84 PID 4844 wrote to memory of 5524 4844 m53997876.exe 92 PID 4844 wrote to memory of 5524 4844 m53997876.exe 92 PID 4844 wrote to memory of 5524 4844 m53997876.exe 92 PID 4404 wrote to memory of 2980 4404 x71553491.exe 96 PID 4404 wrote to memory of 2980 4404 x71553491.exe 96 PID 4404 wrote to memory of 2980 4404 x71553491.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe"C:\Users\Admin\AppData\Local\Temp\6ddf62e2bdbdc9ceb306a448b8859259a969a2f509e982eb319b41184e4206e8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x71553491.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x71553491.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m53997876.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m53997876.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 13844⤵
- Program crash
PID:5924
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n33694289.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n33694289.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4844 -ip 48441⤵PID:5808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
590KB
MD501997f7b7059d410ff9c2ce1590a06db
SHA1b469be148b34521d72004d55527077c2ace06fd8
SHA25616ddca4afb40d9a03e23b102ebb33c402fa1c7c7362c7adad2a4c06b2d246bfe
SHA512268e9a47b54d8298a21e53db5a64436907233947f3682492800647411a0420f9db2395f3ef3274c282732b2859f5d0a5b4b60cafad6d8307859b0a725bfbd874
-
Filesize
530KB
MD5ec317cf5ba53fea9fce2fa2ce9a86cab
SHA1b4d1ce8948e8f9157c8691011c0d04d8d682725f
SHA2566e40c132cc7f78cd02ee8cf9c613ee69bb260c4c8ece6a60dc783cf544214bbd
SHA5121775141facfe519da3236a797aca983d26bdabd1ed3ea6b10bcd42a45174b133388a0d1f157c5a9ede3a24379ca03e74398614d358534c600c6ba8d4419af184
-
Filesize
168KB
MD581f5b6b0c35480bc126ec4bc32c27930
SHA1f53a77e2ee4ab1254911360db82e203686dc8d92
SHA256f4990043e6d32c886fdcb0ac7a2082f7c605f1336d0a736e736ca74808c5c54a
SHA5125f3ca50d82942bc6186fe1dbef4eacd1d39ae62b5d2f69bb421f7da7ba1fa00b6d1ae70e11b3ccf9671e556709c5c403a3b2ab3fec34ae7d702a4817e5f53ca3
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf