Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe
Resource
win10v2004-20241007-en
General
-
Target
ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe
-
Size
437KB
-
MD5
938e10826a2067177444ea95f3e7e8ac
-
SHA1
fbbbd232824c9b05f57ed805255a97ab3a289586
-
SHA256
ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7
-
SHA512
d228441f136cbe88c6e45e7ccc0b77eb01926c99a1c23560ff041d41a2743123a449f0f0e7d820b414f7a4d59b5bbff6ebc797e222cb546aa9ef6c90e75a40d0
-
SSDEEP
12288:1Mray90gxDpY7mEABfobaUyCY7KhVXBtUV1:fyXpY7mEApobDVvxt81
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4736-12-0x0000000004C20000-0x0000000004C66000-memory.dmp family_redline behavioral1/memory/4736-14-0x0000000005260000-0x00000000052A4000-memory.dmp family_redline behavioral1/memory/4736-34-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-76-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-74-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-72-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-70-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-68-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-66-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-64-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-62-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-60-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-58-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-56-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-54-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-52-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-50-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-48-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-46-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-44-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-42-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-40-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-38-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-36-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-32-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-30-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-28-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-26-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-24-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-22-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-78-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-20-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-18-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-16-0x0000000005260000-0x000000000529E000-memory.dmp family_redline behavioral1/memory/4736-15-0x0000000005260000-0x000000000529E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 1 IoCs
pid Process 4736 eju68Sp37.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eju68Sp37.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4736 eju68Sp37.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4472 wrote to memory of 4736 4472 ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe 84 PID 4472 wrote to memory of 4736 4472 ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe 84 PID 4472 wrote to memory of 4736 4472 ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe"C:\Users\Admin\AppData\Local\Temp\ee629e00f0ed7bd707a97b57e7b9eef50815c57d2d3e4fca2e67c387bb5e9cb7.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eju68Sp37.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eju68Sp37.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD5cfe8a5405f2bdada5dafe1bbb5ee9bb3
SHA147181695c79c2b81225a4d24d5b00e003eefd4d7
SHA256b6d33effef48b43f1cdbdd4072aaec30084436366c198f15594dda349b5ed84b
SHA5125b3dace50da121ef0d3c2aaaf5003dd79935e8cade05fc406c24509ce516e06522afb7bd1836136d1f7b3e31c7ac212c53c63105af952c58db70f8907d56a63c