Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:05

General

  • Target

    61f979c3cc609820bd8061f559de11f58d550e4d3f7c603b325266bd9a7c8aa5.exe

  • Size

    782KB

  • MD5

    bb34463a68849937cee62d3b9bb59f95

  • SHA1

    d32a706d2f94638862680bb56742ff84e0b13f80

  • SHA256

    61f979c3cc609820bd8061f559de11f58d550e4d3f7c603b325266bd9a7c8aa5

  • SHA512

    d0e3c797bc484e48b6d716625601f1193cbb3f550412ddad6fd3d032fc0916a8c5dbadfce31364f1fdc375092f3435c2f7409f1f5caddd23225f5daf5f7be745

  • SSDEEP

    12288:ay90w4b4H5WPQWm5vwsmQIOV+ei+f46MM9G9zClqZhW2wF/M580/aaKVmv2OcDpi:ayvo4IP4lwJbYVMp9vW2wmmaV2doVx

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61f979c3cc609820bd8061f559de11f58d550e4d3f7c603b325266bd9a7c8aa5.exe
    "C:\Users\Admin\AppData\Local\Temp\61f979c3cc609820bd8061f559de11f58d550e4d3f7c603b325266bd9a7c8aa5.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x24854258.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x24854258.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:232
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m66681166.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m66681166.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:772
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 1468
          4⤵
          • Program crash
          PID:5480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n41547715.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n41547715.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5564
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 772 -ip 772
    1⤵
      PID:5452

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x24854258.exe

            Filesize

            577KB

            MD5

            5cb688de8a1178f458ccffd44b5afe44

            SHA1

            a6eaba963728ae162a9150e0ec58982a625788b6

            SHA256

            4bc19320d784e0c0bcd021443b737c8538a30bc8d2c7df97a4dad96d4737df04

            SHA512

            d1619f93e2448688c2b6ed7d0a82b53e97be724729683ef07a0dee658f616f8560680385ffbee8d36f41d567667fedb93a338050f1504d7b90a923203e03b795

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m66681166.exe

            Filesize

            574KB

            MD5

            a93ca5d7a2159937ad335d0bf8f333c1

            SHA1

            2d9cf660b14e7b99faefe5f5bc1a870f32e26eb2

            SHA256

            35f36d7a8acf986eaa5f2768798024f6178550c25d2f9ca344756bcaddf5f632

            SHA512

            96915cbaf947721131c36f340e554fdda44fc6a38c12cd4c5f185d781260d947733ea96c53541391c3ffa4691c3f74668c257bd5878a3f404056ecc6dd91c28d

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n41547715.exe

            Filesize

            171KB

            MD5

            69864c2b9a0107f11f03dc73b122b1ce

            SHA1

            7b45cddb34924c46ff0ef7ad99ebfdf3e228aacb

            SHA256

            92e963a721bab48024a7c2e8f4455466b2e007564d4bb1350ae15e0974f7833f

            SHA512

            cc7ae3c45058d7d6f50a922b6cedcb68f7ffbf670339b79172ac8c8869448f05a3cd69a3419d9382fc0dbd0c0d533fc5bf10355e6c810a04bd942bdf74a1b7e3

          • C:\Windows\Temp\1.exe

            Filesize

            168KB

            MD5

            f16fb63d4e551d3808e8f01f2671b57e

            SHA1

            781153ad6235a1152da112de1fb39a6f2d063575

            SHA256

            8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

            SHA512

            fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

          • memory/772-41-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-2188-0x00000000009B0000-0x0000000000AB0000-memory.dmp

            Filesize

            1024KB

          • memory/772-19-0x0000000004DC0000-0x0000000004E28000-memory.dmp

            Filesize

            416KB

          • memory/772-20-0x0000000004F70000-0x0000000005514000-memory.dmp

            Filesize

            5.6MB

          • memory/772-21-0x0000000005560000-0x00000000055C6000-memory.dmp

            Filesize

            408KB

          • memory/772-61-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-73-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-85-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-83-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-81-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-77-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-75-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-71-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-69-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-67-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-65-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-63-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-59-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-57-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-53-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-51-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-33-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-47-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-43-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-17-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

          • memory/772-39-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-18-0x0000000000400000-0x0000000000835000-memory.dmp

            Filesize

            4.2MB

          • memory/772-37-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-49-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-31-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-29-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-27-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-25-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-79-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-23-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-22-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-55-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-45-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/772-2168-0x0000000005760000-0x0000000005792000-memory.dmp

            Filesize

            200KB

          • memory/772-16-0x0000000002270000-0x00000000022CB000-memory.dmp

            Filesize

            364KB

          • memory/772-15-0x00000000009B0000-0x0000000000AB0000-memory.dmp

            Filesize

            1024KB

          • memory/772-2191-0x0000000000400000-0x0000000000835000-memory.dmp

            Filesize

            4.2MB

          • memory/772-2190-0x0000000000400000-0x000000000045E000-memory.dmp

            Filesize

            376KB

          • memory/772-35-0x0000000005560000-0x00000000055C0000-memory.dmp

            Filesize

            384KB

          • memory/5348-2185-0x0000000005330000-0x0000000005342000-memory.dmp

            Filesize

            72KB

          • memory/5348-2186-0x00000000053D0000-0x000000000540C000-memory.dmp

            Filesize

            240KB

          • memory/5348-2187-0x0000000005410000-0x000000000545C000-memory.dmp

            Filesize

            304KB

          • memory/5348-2184-0x00000000054A0000-0x00000000055AA000-memory.dmp

            Filesize

            1.0MB

          • memory/5348-2183-0x00000000059B0000-0x0000000005FC8000-memory.dmp

            Filesize

            6.1MB

          • memory/5348-2182-0x0000000002B60000-0x0000000002B66000-memory.dmp

            Filesize

            24KB

          • memory/5348-2181-0x00000000009C0000-0x00000000009EE000-memory.dmp

            Filesize

            184KB

          • memory/5564-2195-0x0000000000900000-0x0000000000930000-memory.dmp

            Filesize

            192KB

          • memory/5564-2196-0x0000000002AE0000-0x0000000002AE6000-memory.dmp

            Filesize

            24KB