Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 06:49

General

  • Target

    99461ebe46719ac8e1c923a8f28e2af120219ed233907ad27e52be48c90c2caa.exe

  • Size

    774KB

  • MD5

    7ec9e6399a569132b46282467cd99a2b

  • SHA1

    3713dec619ae8935a7d1b3d23d6292093997b2bf

  • SHA256

    99461ebe46719ac8e1c923a8f28e2af120219ed233907ad27e52be48c90c2caa

  • SHA512

    621b571ef52057cc80702e2d76e5e2f43c58bfa2d20f2785f60b16569e265e14f7fad04983359dbdb9eb7d4df08853a03fe891f82688b2814410a1a2ee807ebf

  • SSDEEP

    12288:Ty90/vqnHCxxWAEOqy7fy7JWmP4SvAAG/12ao4I7Kvh0+7NYhvh+BX488:TyGvVr2y7a7JWpSoAN0hD7gSX4V

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99461ebe46719ac8e1c923a8f28e2af120219ed233907ad27e52be48c90c2caa.exe
    "C:\Users\Admin\AppData\Local\Temp\99461ebe46719ac8e1c923a8f28e2af120219ed233907ad27e52be48c90c2caa.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x20627855.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x20627855.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m36664858.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m36664858.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1956
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n82579015.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n82579015.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x20627855.exe

    Filesize

    570KB

    MD5

    8a013de26d91b083642fc6c19ac43104

    SHA1

    3275786002e167210acc86bd65250abe4e488e8a

    SHA256

    5446d6d162a797466707834b48bb77e700fc43e8317981bbb9434e2e118e2611

    SHA512

    9497ab8bfc69ff0c2e34688f416234c3ed31a870923a59b946869ada141469a82c47b9c4fa75f1f7e2b0a7ed8fe5a72285fb377d52859f25d151a4090af978b8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m36664858.exe

    Filesize

    476KB

    MD5

    8ac9e2ee139396c9dd36c4948b879078

    SHA1

    7cd179f7ccdb8fcfc0d3e580d9eb3e59410a8837

    SHA256

    d76152c96a5ce54a42af59f756454289be7a4b79a6776e8e5f7cb019537c7341

    SHA512

    fbdb8f754b4ebc454307fed6f2bdd60e11ecaa30cdff0b490f135f609688b66f5d02e94d50a2ef83114b011af801701adc0d48d656cfd98fcee411eedee563cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n82579015.exe

    Filesize

    169KB

    MD5

    9989826586c60da33f01745be380d0fc

    SHA1

    294f2fac027a6c65298dc09597aef4a51c42f498

    SHA256

    53674ea6ff875402a7098dadd7a6adefb1dafd454ba5be77452bbe25527faddd

    SHA512

    1c6c5c09368ef344c8545537deb4a63e671d067da240662eb0791b945cbb2e2d7a9fd6938c65fb4e693034964eb52119fba8c5b5ba9a263463732f1bb6ecf134

  • C:\Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    f16fb63d4e551d3808e8f01f2671b57e

    SHA1

    781153ad6235a1152da112de1fb39a6f2d063575

    SHA256

    8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

    SHA512

    fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

  • memory/1604-2194-0x00000000052C0000-0x00000000053CA000-memory.dmp

    Filesize

    1.0MB

  • memory/1604-2191-0x00000000007E0000-0x0000000000810000-memory.dmp

    Filesize

    192KB

  • memory/1604-2192-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

    Filesize

    24KB

  • memory/1604-2197-0x0000000005230000-0x000000000527C000-memory.dmp

    Filesize

    304KB

  • memory/1604-2196-0x00000000051F0000-0x000000000522C000-memory.dmp

    Filesize

    240KB

  • memory/1956-2187-0x0000000002800000-0x0000000002806000-memory.dmp

    Filesize

    24KB

  • memory/1956-2195-0x0000000004EF0000-0x0000000004F02000-memory.dmp

    Filesize

    72KB

  • memory/1956-2193-0x00000000056E0000-0x0000000005CF8000-memory.dmp

    Filesize

    6.1MB

  • memory/1956-2182-0x0000000000680000-0x00000000006AE000-memory.dmp

    Filesize

    184KB

  • memory/2036-59-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-39-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-55-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-85-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-83-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-81-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-79-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-75-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-73-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-71-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-69-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-67-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-65-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-63-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-61-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-21-0x0000000005420000-0x0000000005486000-memory.dmp

    Filesize

    408KB

  • memory/2036-57-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-53-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-51-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-49-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-47-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-43-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-41-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-45-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-37-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-35-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-33-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-31-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-29-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-27-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-77-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-25-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-23-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-22-0x0000000005420000-0x0000000005480000-memory.dmp

    Filesize

    384KB

  • memory/2036-2168-0x0000000000890000-0x0000000000990000-memory.dmp

    Filesize

    1024KB

  • memory/2036-2169-0x0000000005620000-0x0000000005652000-memory.dmp

    Filesize

    200KB

  • memory/2036-2184-0x0000000000810000-0x000000000086B000-memory.dmp

    Filesize

    364KB

  • memory/2036-20-0x0000000004E70000-0x0000000005414000-memory.dmp

    Filesize

    5.6MB

  • memory/2036-19-0x0000000002750000-0x00000000027B8000-memory.dmp

    Filesize

    416KB

  • memory/2036-18-0x0000000000400000-0x00000000006F8000-memory.dmp

    Filesize

    3.0MB

  • memory/2036-17-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2036-16-0x0000000000810000-0x000000000086B000-memory.dmp

    Filesize

    364KB

  • memory/2036-15-0x0000000000890000-0x0000000000990000-memory.dmp

    Filesize

    1024KB

  • memory/2036-2186-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2036-2185-0x0000000000400000-0x00000000006F8000-memory.dmp

    Filesize

    3.0MB