Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:17

General

  • Target

    38b2f087885ad02ba55a3635b06fbc8d7368a997f63ec10d96ea3e1c01481923.exe

  • Size

    1015KB

  • MD5

    0474cefe821eaa7c98ca36028b4698b1

  • SHA1

    09c71e7bb7d3e420649970b477cf908989281aa8

  • SHA256

    38b2f087885ad02ba55a3635b06fbc8d7368a997f63ec10d96ea3e1c01481923

  • SHA512

    472dd8564925866535f6a8d5b5d2d7f2e38379112fd56aeaa114663190b7b2db0c7c8075fc4f8d4dd19fd8037500c3ccbeebeadf41f18ec519e2a4924f85d5a0

  • SSDEEP

    24576:CyntmEEIdvvRmeZrOTzVVs9HV6reK3mSk/RS2Esd5j:ptiI1pmeUVs6aYiJtEW

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38b2f087885ad02ba55a3635b06fbc8d7368a997f63ec10d96ea3e1c01481923.exe
    "C:\Users\Admin\AppData\Local\Temp\38b2f087885ad02ba55a3635b06fbc8d7368a997f63ec10d96ea3e1c01481923.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i19703148.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i19703148.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i55206354.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i55206354.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4012
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a17825952.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a17825952.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i19703148.exe

    Filesize

    843KB

    MD5

    282f2a5eb18dce9ba508f0bb62e53d8c

    SHA1

    5ce9da3d71af2b74c49447de61e26d951b43720d

    SHA256

    8044726d78b8d4acaa7fd0dd819472076c2f605d81f8502a5747b6d08174790f

    SHA512

    83bdc61b2cde4701a25e27f656549d782ae28b085e1801833a5a373f3f5d85b0d3f4dce732114960d4e2d6a4e15e964946edabbc765bc72f0703385e0c11e804

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i55206354.exe

    Filesize

    371KB

    MD5

    5549989438ee6c704a23a7a637178750

    SHA1

    f1efbe87eed0cd040541491811c8a6142ef9e4ec

    SHA256

    c62c223e1d2cae23de64ebf545fc091c7fac3b1bb4aae9473645dc566f379812

    SHA512

    f1eabc7457b0773b22d745c401db2b67d4430590433778896b5bbcbcc7c4b08d174e7599a25585f710b1aafd68a00a4756ff604e16d6af4644c135725b06a2e9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a17825952.exe

    Filesize

    169KB

    MD5

    3835fb0e49c8bd776b55f96534aa9bb9

    SHA1

    63118ed0b06d166440837cebacf528dc9c325816

    SHA256

    302cb0e099bb50eedf0cad27654917c7311a4662e52888f54116ca2ce008f579

    SHA512

    da4411146bf120646348a5ca965ecea68f2ecc2cc5bcb67a61919e88e22bc1bdb2d761a6e06104e0e345d7100eb5c4c0d1641d292c7c21df59f083df5b7a359b

  • memory/4284-21-0x0000000000740000-0x0000000000770000-memory.dmp

    Filesize

    192KB

  • memory/4284-22-0x0000000004F60000-0x0000000004F66000-memory.dmp

    Filesize

    24KB

  • memory/4284-23-0x00000000056E0000-0x0000000005CF8000-memory.dmp

    Filesize

    6.1MB

  • memory/4284-24-0x00000000051D0000-0x00000000052DA000-memory.dmp

    Filesize

    1.0MB

  • memory/4284-25-0x00000000050C0000-0x00000000050D2000-memory.dmp

    Filesize

    72KB

  • memory/4284-26-0x0000000005120000-0x000000000515C000-memory.dmp

    Filesize

    240KB

  • memory/4284-27-0x0000000005170000-0x00000000051BC000-memory.dmp

    Filesize

    304KB