Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:11

General

  • Target

    78372e7554a19746b1154f134ce7a4220fb6c4e3687c367e9f6996a65f9e3268.exe

  • Size

    376KB

  • MD5

    0e0a0c8cf35e2b306709246aaf10fd90

  • SHA1

    c3797c3c6f6dc4f879f06fbf6c7edd57c3545fe6

  • SHA256

    78372e7554a19746b1154f134ce7a4220fb6c4e3687c367e9f6996a65f9e3268

  • SHA512

    60489480638273c8689eab1a2c8101ba19444bba5e187d80210214a64fa0aff801b4fad1850cae5d15f95af04bf3231e881c0e360239cdbccb24c1a525f9ec52

  • SSDEEP

    6144:Kiy+bnr+wp0yN90QEdxb9RZL0aOkE/5eHFZOu39r7M0NjSW3+/L9S8Gtq7eVeQ:SMroy90jRZw0KYFZ/tnM6SWGhvGtyeVr

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78372e7554a19746b1154f134ce7a4220fb6c4e3687c367e9f6996a65f9e3268.exe
    "C:\Users\Admin\AppData\Local\Temp\78372e7554a19746b1154f134ce7a4220fb6c4e3687c367e9f6996a65f9e3268.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8374375.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8374375.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5614046.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5614046.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3124

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8374375.exe

          Filesize

          204KB

          MD5

          8e53b584959d462596f7b84fe0eb278e

          SHA1

          82a6a915713cc2454aa94ed7f928180be8c93e84

          SHA256

          5cffef2d19eb07318f757c7851d9d2042b2ae54dae3af7f473ade5ac8b219e89

          SHA512

          22b89e77e14b57892ca088f2b27d94b590125c40ddbdc06a7274761e9d784784e7b6607054941320b71ebf78c2f55524b4f534ae059b9b9ef91ab43acdfafd18

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5614046.exe

          Filesize

          136KB

          MD5

          fde49fb6777171e785d6aa949bc1d6d5

          SHA1

          ebcdea07bf8d7b9ae907f669ab87fce2a50f3fb5

          SHA256

          3d4c859dbca7bec82f0466ab4a72b106a5dc7f661f55a92d408bae6ad5f38206

          SHA512

          a8d431ea1b0137e3aa8981aeafbd666a77e2f5004da5f3210d0790c4d8151face8be58ed5add0b86f4529da3a446eafd99903010e15de9a734fa31f752482e20

        • memory/3124-14-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

          Filesize

          4KB

        • memory/3124-15-0x0000000000540000-0x0000000000568000-memory.dmp

          Filesize

          160KB

        • memory/3124-16-0x0000000007900000-0x0000000007F18000-memory.dmp

          Filesize

          6.1MB

        • memory/3124-17-0x00000000073A0000-0x00000000073B2000-memory.dmp

          Filesize

          72KB

        • memory/3124-18-0x0000000007510000-0x000000000761A000-memory.dmp

          Filesize

          1.0MB

        • memory/3124-19-0x0000000007440000-0x000000000747C000-memory.dmp

          Filesize

          240KB

        • memory/3124-20-0x0000000074B00000-0x00000000752B0000-memory.dmp

          Filesize

          7.7MB

        • memory/3124-21-0x0000000004990000-0x00000000049DC000-memory.dmp

          Filesize

          304KB

        • memory/3124-22-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

          Filesize

          4KB

        • memory/3124-23-0x0000000074B00000-0x00000000752B0000-memory.dmp

          Filesize

          7.7MB