Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 09:16
Static task
static1
Behavioral task
behavioral1
Sample
a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe
Resource
win10v2004-20241007-en
General
-
Target
a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe
-
Size
738KB
-
MD5
f4505db6a8288c24c990091d57b8e0c0
-
SHA1
e83ad43d985e6f7fe4a323d8402dfb247c68ec93
-
SHA256
a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59
-
SHA512
08497947dc5d1e61231e5da179e2b3a13525b54d3304cc3d62f61d33470111542b621cb3dba801a682632b3394fd0325375f5773cdd0d14672ec38a93c51fc4d
-
SSDEEP
12288:hMr+y90dL6VBPScvwWD2B6uG8+R88QRRIPFpUx6DRYFF97FtzRf5:LyxVlGK7R88QRRIjUx6DRiffFx
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0009000000023c55-19.dat family_redline behavioral1/memory/336-21-0x0000000000760000-0x0000000000792000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
sCO76Bu.exeseO45bO.exekMj13yz.exepid Process 4876 sCO76Bu.exe 2156 seO45bO.exe 336 kMj13yz.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exesCO76Bu.exeseO45bO.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sCO76Bu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" seO45bO.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
seO45bO.exekMj13yz.exea959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exesCO76Bu.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seO45bO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kMj13yz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sCO76Bu.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exesCO76Bu.exeseO45bO.exedescription pid Process procid_target PID 5080 wrote to memory of 4876 5080 a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe 84 PID 5080 wrote to memory of 4876 5080 a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe 84 PID 5080 wrote to memory of 4876 5080 a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe 84 PID 4876 wrote to memory of 2156 4876 sCO76Bu.exe 85 PID 4876 wrote to memory of 2156 4876 sCO76Bu.exe 85 PID 4876 wrote to memory of 2156 4876 sCO76Bu.exe 85 PID 2156 wrote to memory of 336 2156 seO45bO.exe 86 PID 2156 wrote to memory of 336 2156 seO45bO.exe 86 PID 2156 wrote to memory of 336 2156 seO45bO.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe"C:\Users\Admin\AppData\Local\Temp\a959cfb88e477c52a06908b0a6290b0f6cfe1661ec38dd0bfad4bfe2da287e59.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sCO76Bu.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sCO76Bu.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\seO45bO.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\seO45bO.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kMj13yz.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kMj13yz.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:336
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD55fbb0d79cae435900f7d06218a74f909
SHA1bc5cb3a5494517bae48680b5d8fa9a2baee0cebf
SHA256e7ae48923118e31efc26db6344a84b886b0243b3e8413eb754098666c165fe06
SHA512da3b821649f560de0253cbd7671c833a5f54d9b23d6033bbaab6296b9e35b99bf01ba13e7de3713bd9f20dd84feb13e94aba79bd46adee8f58be18c27be48fb5
-
Filesize
286KB
MD5972f3c99da86f0b6d6daf95e4e0154bf
SHA1bfd0c1dc555f6b2855d9996d6d51e64237a5b574
SHA256c6f54c0ef99683f74c00dde1eeb01ec8b4d68bd5ad1f72f1cbc269b20f9b1f5c
SHA512ceae51f7eee96e33bc7393d9ab465037f637d6f298a640a571d2aa777be38865adb91362d376b01cfa437100cb4c2f5450372c5a07f1de6573efcdcf07201cbb
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec