Analysis

  • max time kernel
    110s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:13

General

  • Target

    cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe

  • Size

    577KB

  • MD5

    3e561c2040dcae5eba631fe63eb60b30

  • SHA1

    9cbbd9e4b074074e033be546439ae7fb0e3ae01c

  • SHA256

    cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109c

  • SHA512

    99fc9ab4cc8e6a3b2c0bcd7a2bf5b660b9cf0609b29fadf9340487d53f9f2b71bce92c8750a3046d508fe5b94e5831e1c262c1c423e42f891a57db5285948604

  • SSDEEP

    12288:Oy9037VAW0vyIq+UtA9z5LHRIgtDHHZgBzsbpSdXROrgo2HnyDiH3l:OyuSvyIuAp5LHRIgJHH2BoSJROcoMn31

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dark

C2

185.161.248.73:4164

Attributes
  • auth_value

    ae85b01f66afe8770afeed560513fc2d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe
    "C:\Users\Admin\AppData\Local\Temp\cfa85c9aec50350d95b8b5daa95b54d00c5c6636b1697fab614781432e43109cN.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4192
      • C:\Windows\Temp\1.exe
        "C:\Windows\Temp\1.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1384
        3⤵
        • Program crash
        PID:976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5320
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4192 -ip 4192
    1⤵
      PID:3504

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m33178016.exe

      Filesize

      575KB

      MD5

      2c96d4d854acee0503cfc5f4759cebf5

      SHA1

      933991c7d06b62e0a716dc9a23ab0c94b09b3f59

      SHA256

      1beca08441d61c6c1afdc8d983d2bfc4f5fe913df3f3457d93d997b70ff0b489

      SHA512

      69199469727c4fc471d6b72856d2686e628015bc75e68064eabea07b99cf3e3fbe2ca86ee4b31066d1773a69654321c37688453977de3aac74e3b5b7ce1cfb7d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n93965724.exe

      Filesize

      172KB

      MD5

      34bc8de328c8b062661ae32d31054fa6

      SHA1

      bdd92bb5496d9d8b118149b07be52e2582a3cbbb

      SHA256

      58c3bee46bd1a23ab699328fbb5aa682d883063c7327486e82e0b1b1a3285ef7

      SHA512

      f799bd0f2b4dd32cb9874fdce5c562f3eee141f29e2948ef21eb0f67f5e2ae84c3a4d98e4b49d0deca1acdd0cea27ea18b08c08f7d05b02d09efcb9f3f9b67e8

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/4192-34-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-12-0x00000000028B0000-0x0000000002918000-memory.dmp

      Filesize

      416KB

    • memory/4192-32-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-11-0x0000000000400000-0x0000000000835000-memory.dmp

      Filesize

      4.2MB

    • memory/4192-30-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-13-0x0000000005010000-0x00000000055B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4192-14-0x00000000055C0000-0x0000000005626000-memory.dmp

      Filesize

      408KB

    • memory/4192-74-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-78-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-76-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-72-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-70-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-68-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-66-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-64-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-62-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-60-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-56-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-54-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-52-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-50-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-48-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-46-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-44-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-28-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-38-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-36-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-8-0x00000000009D0000-0x0000000000AD0000-memory.dmp

      Filesize

      1024KB

    • memory/4192-10-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/4192-9-0x0000000000970000-0x00000000009CB000-memory.dmp

      Filesize

      364KB

    • memory/4192-42-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-26-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-22-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-20-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-18-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-16-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-15-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-58-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-40-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-24-0x00000000055C0000-0x0000000005620000-memory.dmp

      Filesize

      384KB

    • memory/4192-2162-0x0000000004ED0000-0x0000000004F02000-memory.dmp

      Filesize

      200KB

    • memory/4192-2161-0x00000000009D0000-0x0000000000AD0000-memory.dmp

      Filesize

      1024KB

    • memory/4192-2181-0x0000000000970000-0x00000000009CB000-memory.dmp

      Filesize

      364KB

    • memory/4192-2186-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/4192-2187-0x0000000000400000-0x0000000000835000-memory.dmp

      Filesize

      4.2MB

    • memory/4484-2180-0x0000000004DF0000-0x0000000004E02000-memory.dmp

      Filesize

      72KB

    • memory/4484-2175-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

      Filesize

      4KB

    • memory/4484-2177-0x0000000002700000-0x0000000002706000-memory.dmp

      Filesize

      24KB

    • memory/4484-2178-0x00000000053C0000-0x00000000059D8000-memory.dmp

      Filesize

      6.1MB

    • memory/4484-2179-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

      Filesize

      1.0MB

    • memory/4484-2176-0x0000000000470000-0x000000000049E000-memory.dmp

      Filesize

      184KB

    • memory/4484-2182-0x0000000004E50000-0x0000000004E8C000-memory.dmp

      Filesize

      240KB

    • memory/4484-2183-0x0000000073D50000-0x0000000074500000-memory.dmp

      Filesize

      7.7MB

    • memory/4484-2184-0x0000000004FD0000-0x000000000501C000-memory.dmp

      Filesize

      304KB

    • memory/4484-2193-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

      Filesize

      4KB

    • memory/4484-2194-0x0000000073D50000-0x0000000074500000-memory.dmp

      Filesize

      7.7MB

    • memory/5320-2191-0x0000000000180000-0x00000000001B0000-memory.dmp

      Filesize

      192KB

    • memory/5320-2192-0x0000000002340000-0x0000000002346000-memory.dmp

      Filesize

      24KB