Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 15:25
Static task
static1
Behavioral task
behavioral1
Sample
c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe
Resource
win10v2004-20241007-en
General
-
Target
c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe
-
Size
715KB
-
MD5
e3d4fec4a29b54648f558a4d1922955a
-
SHA1
efaed0851a08ab3027543ccc2f925eabe1090056
-
SHA256
c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5
-
SHA512
1215aa0b4ad97994aaab57b348a2b214ccdb2482e6c5cb26b61f4d390d13fe7f9b4251c5d0052673bab8fe84856ca30b30796118ee4c32e992cdb3e0833dd869
-
SSDEEP
12288:5Mrfy901NyfehFzcaJU/ivZn5J0Db5V88eKfIPToQpLcMkYinMCsslpBD1kul:+ymNBDtU6vPaD388eKfILoXM5s3phl
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000023c9b-19.dat family_redline behavioral1/memory/244-21-0x0000000000430000-0x0000000000462000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
Processes:
sGL84KY.exesTw52tV.exekLu30IG.exepid Process 3716 sGL84KY.exe 4480 sTw52tV.exe 244 kLu30IG.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exesGL84KY.exesTw52tV.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sGL84KY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sTw52tV.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
sGL84KY.exesTw52tV.exekLu30IG.exec351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sGL84KY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sTw52tV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kLu30IG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exesGL84KY.exesTw52tV.exedescription pid Process procid_target PID 4220 wrote to memory of 3716 4220 c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe 83 PID 4220 wrote to memory of 3716 4220 c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe 83 PID 4220 wrote to memory of 3716 4220 c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe 83 PID 3716 wrote to memory of 4480 3716 sGL84KY.exe 84 PID 3716 wrote to memory of 4480 3716 sGL84KY.exe 84 PID 3716 wrote to memory of 4480 3716 sGL84KY.exe 84 PID 4480 wrote to memory of 244 4480 sTw52tV.exe 86 PID 4480 wrote to memory of 244 4480 sTw52tV.exe 86 PID 4480 wrote to memory of 244 4480 sTw52tV.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe"C:\Users\Admin\AppData\Local\Temp\c351392754026e469c6ee6f13b288d242bbe6592d1cd79b2018a073259b9f7c5.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sGL84KY.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sGL84KY.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sTw52tV.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sTw52tV.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kLu30IG.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kLu30IG.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:244
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
611KB
MD5b4c73663e2f92cd1c55d2e19364b21e6
SHA18844efaaf09b1f05cfc5f781d1f80ceb9c44871e
SHA256e47f2b9dfbf610cd2565e7070b87f49ff2691cdb85d1051678ae81929108f09c
SHA5128dafb5c97f38481766920fa0dbd5c8bf0cc1246787225b662378eb0a90f91965283d613faf3bd4f2d8dcb351c9a73604ee3956f405ac5454de56584ef6adc005
-
Filesize
286KB
MD5eef8f98960ef39ae41fb8e49eb927bb8
SHA109248a92d4ea36ddb601a64999fa53162871dd3d
SHA2567d6a5ed69e203044da588455a6e434984da777009f8f66f4fed28934252d1ad9
SHA51295ca7e6a33573af1b48abede0bc068213dfb3419b7fd73bacb4a89ee0905e1f9776a25ccc65e5e0111b533cfb5030e1b18f5ba4e29b2ece682d6020286af5fc2
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec