Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:32

General

  • Target

    9da8581dbafbb0379a7d3a0973bd2032ebe454403328ea685bfbf3e10aad5f90.exe

  • Size

    583KB

  • MD5

    2ff597a7d357b503415e4e109ea8acb5

  • SHA1

    2b3a11c68021aa35f6632e40f4e4371890f6e82a

  • SHA256

    9da8581dbafbb0379a7d3a0973bd2032ebe454403328ea685bfbf3e10aad5f90

  • SHA512

    b2333d81e9ab85854548d2623e4a67ad1b309c691b9c68193a319e9d55cc4e99dd3404ed023621ad646b40a9931da189c7f32ac4a41d2c75360ce6e0cf2212bd

  • SSDEEP

    12288:yMr8y90MnJLaFesl6kN3NlOx09nXshwJYI1h/1uTCb9WPw:ey1hlsl6qua9XsuJ31h/AucY

Malware Config

Extracted

Family

redline

Botnet

ronam

C2

193.233.20.17:4139

Attributes
  • auth_value

    125421d19d14dd7fd211bc7f6d4aea6c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9da8581dbafbb0379a7d3a0973bd2032ebe454403328ea685bfbf3e10aad5f90.exe
    "C:\Users\Admin\AppData\Local\Temp\9da8581dbafbb0379a7d3a0973bd2032ebe454403328ea685bfbf3e10aad5f90.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHK59mG47.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHK59mG47.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eKK34sA.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eKK34sA.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nHK59mG47.exe

    Filesize

    438KB

    MD5

    fae44dfa80d8195f0073ee1998110caf

    SHA1

    c897be046e693f655fe826581cb6b21b9efa75a5

    SHA256

    4b938cadc8fa24e4f782cddb3b4b42fe8cba9d783d987dcbbe1f580195f75f0e

    SHA512

    8ab0899c633233ae1d7041d1b960fa6ba870c34a8f181059ff4cecc644c62a743cb3cb057aea565c2193dadcd85a385e3ed24acdd221f4ea0220e333bdf1ae8d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eKK34sA.exe

    Filesize

    298KB

    MD5

    56104654a290de3b309be77f180397ad

    SHA1

    ff007a7bb24a41681b4209ae0b686fde0d29116f

    SHA256

    ae36b4154ab3e8fddbe9427ae45003752ec3d70108fa321c9fbcd987789bf3a7

    SHA512

    fcbf7b2b9b4c82087b667bea595d093d4f4f58e1b36ec283aeb48bd70370e5701331762b9a85613d3aae711548dc958f4b63d266f4a9e33adee625b0536e55c0

  • memory/1576-15-0x0000000000890000-0x0000000000990000-memory.dmp

    Filesize

    1024KB

  • memory/1576-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1576-16-0x0000000000670000-0x00000000006BB000-memory.dmp

    Filesize

    300KB

  • memory/1576-18-0x0000000000400000-0x000000000062B000-memory.dmp

    Filesize

    2.2MB

  • memory/1576-19-0x0000000002350000-0x0000000002396000-memory.dmp

    Filesize

    280KB

  • memory/1576-20-0x0000000004D40000-0x00000000052E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1576-21-0x0000000002710000-0x0000000002754000-memory.dmp

    Filesize

    272KB

  • memory/1576-75-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-85-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-83-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-81-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-79-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-77-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-73-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-71-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-69-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-67-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-65-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-61-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-59-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-58-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-56-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-53-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-51-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-47-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-45-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-43-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-41-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-39-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-37-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-35-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-33-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-31-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-27-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-25-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-23-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-22-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-63-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-49-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-29-0x0000000002710000-0x000000000274E000-memory.dmp

    Filesize

    248KB

  • memory/1576-928-0x00000000052F0000-0x0000000005908000-memory.dmp

    Filesize

    6.1MB

  • memory/1576-929-0x0000000005910000-0x0000000005A1A000-memory.dmp

    Filesize

    1.0MB

  • memory/1576-931-0x0000000000890000-0x0000000000990000-memory.dmp

    Filesize

    1024KB

  • memory/1576-930-0x0000000005A40000-0x0000000005A52000-memory.dmp

    Filesize

    72KB

  • memory/1576-932-0x0000000005A60000-0x0000000005A9C000-memory.dmp

    Filesize

    240KB

  • memory/1576-933-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

    Filesize

    304KB

  • memory/1576-934-0x0000000000670000-0x00000000006BB000-memory.dmp

    Filesize

    300KB

  • memory/1576-935-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB