Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:57

General

  • Target

    e07c912b3c149c55e4ca5a78efab0851fa916104e7bde47c807c08e6f7f83a57.exe

  • Size

    479KB

  • MD5

    e7965ca9055039b489ca71559dfd5c75

  • SHA1

    3a8a6252acdb0502b36eead1a8566340d2926ce4

  • SHA256

    e07c912b3c149c55e4ca5a78efab0851fa916104e7bde47c807c08e6f7f83a57

  • SHA512

    589338123ae3aee89abce148d5e676b3f439e94ad853e166a0a201e8b9c8c70d7f292201fb4cae28699cec08eefea80ea21d23cb610b9fa294accc59cb54e9e7

  • SSDEEP

    12288:9Mr8y90rbd6jBRLEQFt/OMFHq6ROwcu7llXbLW2KK+jhbio:NyWMj7NhXZcsllrK2ijdio

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e07c912b3c149c55e4ca5a78efab0851fa916104e7bde47c807c08e6f7f83a57.exe
    "C:\Users\Admin\AppData\Local\Temp\e07c912b3c149c55e4ca5a78efab0851fa916104e7bde47c807c08e6f7f83a57.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5797596.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5797596.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6454532.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6454532.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5797596.exe

          Filesize

          308KB

          MD5

          92e47edf941ebab740318596c78c9e15

          SHA1

          a5e9c16a2c688ad5f67026d3c77202d10e09b5db

          SHA256

          9be039b190737a31b0d21b52c6c998c239882bc7de361207110b2cf74e68eadb

          SHA512

          c9aea86504e029ac844d12fc28c76d947f658d3069f19ae445fe58b71ef2027979f7b4fcf3fa6d19400b2a99f31b7a8ccefdb4b89d04a8d3ea68bb595d4769e1

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g6454532.exe

          Filesize

          136KB

          MD5

          3e9f6e9eba4aa15f0ae505ff43a7d6df

          SHA1

          b3672d6fc06f39e34e343dc9ada0c87ccc8d39f7

          SHA256

          602d299e2468dffc678bc05b7c14125acdc29bd1326b831f6fe296ef2f9229b5

          SHA512

          3f349957f65befe80d80ee1b637ee34a6e25167e7a654c7d0154c77e35c97013c1abc78cee41cb5ecbbd077c04586fa59b2b935aceca04784fb59aeabe634d83

        • memory/3652-14-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

          Filesize

          4KB

        • memory/3652-15-0x0000000000B00000-0x0000000000B28000-memory.dmp

          Filesize

          160KB

        • memory/3652-16-0x0000000007D80000-0x0000000008398000-memory.dmp

          Filesize

          6.1MB

        • memory/3652-17-0x0000000007820000-0x0000000007832000-memory.dmp

          Filesize

          72KB

        • memory/3652-18-0x0000000007990000-0x0000000007A9A000-memory.dmp

          Filesize

          1.0MB

        • memory/3652-19-0x00000000078C0000-0x00000000078FC000-memory.dmp

          Filesize

          240KB

        • memory/3652-20-0x0000000073EA0000-0x0000000074650000-memory.dmp

          Filesize

          7.7MB

        • memory/3652-21-0x0000000002C40000-0x0000000002C8C000-memory.dmp

          Filesize

          304KB

        • memory/3652-22-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

          Filesize

          4KB

        • memory/3652-23-0x0000000073EA0000-0x0000000074650000-memory.dmp

          Filesize

          7.7MB