Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 07:19

General

  • Target

    1811ec9fb6c7ff8d6e523e4b4ac820f72a9ce8fdda97e36434b3a84c2259ba29.exe

  • Size

    474KB

  • MD5

    3499ef398a88c7b9e25b72b77e374c7c

  • SHA1

    d93a7b2d958523b6c39c4d041a34f85cefceb9e7

  • SHA256

    1811ec9fb6c7ff8d6e523e4b4ac820f72a9ce8fdda97e36434b3a84c2259ba29

  • SHA512

    be789556b5f5ba1383ca0afd0773548c95ceb270f51de9c7bfd68556e5701b8efbd51a583c7ed7573f0c33aecffa5227e960a9a8b1c37fc043b04c16e13c15b4

  • SSDEEP

    6144:KQy+bnr+5p0yN90QEkk4iZCEtUzJGOLVfoGbfQ5Cm35LHSyOOWMyEa7n:QMrJy90uk4LuUzzVfRfQwm31pXyt

Malware Config

Extracted

Family

redline

Botnet

fusa

C2

193.233.20.12:4132

Attributes
  • auth_value

    a08b2f01bd2af756e38c5dd60e87e697

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1811ec9fb6c7ff8d6e523e4b4ac820f72a9ce8fdda97e36434b3a84c2259ba29.exe
    "C:\Users\Admin\AppData\Local\Temp\1811ec9fb6c7ff8d6e523e4b4ac820f72a9ce8fdda97e36434b3a84c2259ba29.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSI73.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSI73.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bWA65.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bWA65.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nSI73.exe

    Filesize

    200KB

    MD5

    370f04af9c734d5af5038cab0cb9329d

    SHA1

    a129b9e8ff9fd039b4dd5572226c2743c8e81a16

    SHA256

    604021846348b224d19fecd5ba6393066c5151a1b2fe6caac1f430ca15edb0a5

    SHA512

    6b0e274ba10f18716edc985a20791c0b5ae9364bfecc9036aba7fc38ce661084f96cc96d0687940d98f5cb99b41d2bfcf4a499928288f876486f9af9a28af290

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bWA65.exe

    Filesize

    175KB

    MD5

    da6f3bef8abc85bd09f50783059964e3

    SHA1

    a0f25f60ec1896c4c920ea397f40e6ce29724322

    SHA256

    e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b

    SHA512

    4d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec

  • memory/4672-14-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

    Filesize

    4KB

  • memory/4672-15-0x0000000000F20000-0x0000000000F52000-memory.dmp

    Filesize

    200KB

  • memory/4672-16-0x0000000005DC0000-0x00000000063D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4672-17-0x00000000058C0000-0x00000000059CA000-memory.dmp

    Filesize

    1.0MB

  • memory/4672-18-0x0000000005810000-0x0000000005822000-memory.dmp

    Filesize

    72KB

  • memory/4672-19-0x0000000005870000-0x00000000058AC000-memory.dmp

    Filesize

    240KB

  • memory/4672-20-0x00000000059D0000-0x0000000005A1C000-memory.dmp

    Filesize

    304KB

  • memory/4672-21-0x0000000073C1E000-0x0000000073C1F000-memory.dmp

    Filesize

    4KB