Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 10:03
Static task
static1
Behavioral task
behavioral1
Sample
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe
Resource
win10v2004-20241007-en
General
-
Target
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe
-
Size
474KB
-
MD5
fe7a3f15cfd78c7080662c36fe17559b
-
SHA1
d2971e683c7db50cdb30676801f7894bcfaee405
-
SHA256
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0
-
SHA512
7fe6824e0854fb620f13e98ee45139974b543aa420f65d3b8603393d0c93a1f9f3264ef29126373762972dc744c7aeb8b029746af72b0e088658858bf583e19e
-
SSDEEP
6144:KCy+bnr+Vp0yN90QEljpenMVXoc6uT5NQU58DEDxgP1behvVJ3ZzmXFel4kywtEK:OMrZy907pcMVW85x9gNKVJ3REaweEK
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000023c9b-12.dat family_redline behavioral1/memory/384-15-0x00000000000A0000-0x00000000000D2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
Processes:
nZR34.exebyP53.exepid Process 4312 nZR34.exe 384 byP53.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exenZR34.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nZR34.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exenZR34.exebyP53.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nZR34.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language byP53.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exenZR34.exedescription pid Process procid_target PID 1588 wrote to memory of 4312 1588 44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe 83 PID 1588 wrote to memory of 4312 1588 44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe 83 PID 1588 wrote to memory of 4312 1588 44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe 83 PID 4312 wrote to memory of 384 4312 nZR34.exe 84 PID 4312 wrote to memory of 384 4312 nZR34.exe 84 PID 4312 wrote to memory of 384 4312 nZR34.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe"C:\Users\Admin\AppData\Local\Temp\44f6eeb3545c0677a19f0bcf027ed15ab37f907bfae491ecdf867a9482c89ae0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nZR34.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nZR34.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\byP53.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\byP53.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:384
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD58401fb899da3b22fc917921cecaf8d85
SHA167f83202a8c48316343cad8c0f04c72d83b37666
SHA2562f065858bd4f2a207ed3cbc839262d041df05ab829eb547061515f25680426b3
SHA5121dd0889310d765aeb9ada14cb6be48d7519c020c060a5b1933ed15390f19804422607badc935f250dd1ccf91f117d94d149908d2ec2a54c1e53ca571f5488ac3
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec