Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:04

General

  • Target

    9068b9d228f6825a8d1560b69c49ae9d92314e5ac81e72324228773e8a66165d.exe

  • Size

    443KB

  • MD5

    22aaeaed05e4de184aac222490d949cb

  • SHA1

    f3fdbf7ecfeaabeff401fd3523b1d92ecf72bddb

  • SHA256

    9068b9d228f6825a8d1560b69c49ae9d92314e5ac81e72324228773e8a66165d

  • SHA512

    e0b776d55da5bbf2ef637e524dcc5c473cc14f1fdfbfa1d9a024005f3d11fb169ad4584a75e8e3a47b7a5e689a8b1889f9bc445b1f28dc1dcf73b912b3a83f67

  • SSDEEP

    12288:gMrly90MfQcBrtlTzsTJ3ktlpGsuAiHfp2Y9l:1ypJrtRzsTyl0Hxn

Malware Config

Extracted

Family

redline

Botnet

ramon

C2

193.233.20.23:4123

Attributes
  • auth_value

    3197576965d9513f115338c233015b40

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9068b9d228f6825a8d1560b69c49ae9d92314e5ac81e72324228773e8a66165d.exe
    "C:\Users\Admin\AppData\Local\Temp\9068b9d228f6825a8d1560b69c49ae9d92314e5ac81e72324228773e8a66165d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wBt08IB10.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wBt08IB10.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3512

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wBt08IB10.exe

          Filesize

          375KB

          MD5

          c10daf863897d09c0099746f7abf1fea

          SHA1

          2e01761ba4f9b1a3129cb7b8d8464c7e6ca0ceb8

          SHA256

          ae58c920938274bd9fe7859eebb65af80586474260e58a3b433c5f486045b9e0

          SHA512

          8ad26a211ab620e87b563ba8e372296f34df728b5bbb0de394a04774249474a4facaafbac9f010895571e9cf499b61e8c60d91d885a621f7b4b296e38770d0ba

        • memory/3512-8-0x0000000002D80000-0x0000000002E80000-memory.dmp

          Filesize

          1024KB

        • memory/3512-9-0x0000000004820000-0x000000000486B000-memory.dmp

          Filesize

          300KB

        • memory/3512-10-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB

        • memory/3512-11-0x0000000004D00000-0x0000000004D46000-memory.dmp

          Filesize

          280KB

        • memory/3512-12-0x0000000007480000-0x0000000007A24000-memory.dmp

          Filesize

          5.6MB

        • memory/3512-13-0x00000000072F0000-0x0000000007334000-memory.dmp

          Filesize

          272KB

        • memory/3512-62-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-60-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-78-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-76-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-74-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-72-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-70-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-68-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-66-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-64-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-58-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-56-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-54-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-52-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-50-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-48-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-44-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-42-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-40-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-38-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-36-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-34-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-32-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-30-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-28-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-26-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-24-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-22-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-20-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-18-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-16-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-15-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-46-0x00000000072F0000-0x000000000732E000-memory.dmp

          Filesize

          248KB

        • memory/3512-14-0x0000000000400000-0x0000000002BCA000-memory.dmp

          Filesize

          39.8MB

        • memory/3512-921-0x0000000007A30000-0x0000000008048000-memory.dmp

          Filesize

          6.1MB

        • memory/3512-922-0x0000000008050000-0x000000000815A000-memory.dmp

          Filesize

          1.0MB

        • memory/3512-923-0x0000000007420000-0x0000000007432000-memory.dmp

          Filesize

          72KB

        • memory/3512-924-0x0000000008160000-0x000000000819C000-memory.dmp

          Filesize

          240KB

        • memory/3512-925-0x00000000082C0000-0x000000000830C000-memory.dmp

          Filesize

          304KB

        • memory/3512-926-0x0000000002D80000-0x0000000002E80000-memory.dmp

          Filesize

          1024KB

        • memory/3512-927-0x0000000004820000-0x000000000486B000-memory.dmp

          Filesize

          300KB

        • memory/3512-929-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB