Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe
Resource
win10v2004-20241007-en
General
-
Target
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe
-
Size
550KB
-
MD5
04592016c16df579611c729432bf2b5e
-
SHA1
72680dc20f5d2281b3d8ce882f79b802e2970dff
-
SHA256
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb
-
SHA512
2910348cbd1bcf9e3aebb1ebe4f0ba198e1f6aacd2dc7e40c1325760f480b811445685ccfb4e2793373d436a7c1469dc312f43f11a4214dbd373bd735155bbce
-
SSDEEP
12288:JMrXy90FczAPOorfP95unQXALafT+maD0Zdd+kFRfnq:2yxzerfV5C9ma0XRfq
Malware Config
Extracted
redline
fusa
193.233.20.12:4132
-
auth_value
a08b2f01bd2af756e38c5dd60e87e697
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0009000000023c47-12.dat family_redline behavioral1/memory/2940-15-0x0000000000CB0000-0x0000000000CE2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
Processes:
nes97.exebtp45.exepid Process 3584 nes97.exe 2940 btp45.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exenes97.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nes97.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exenes97.exebtp45.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nes97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btp45.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exenes97.exedescription pid Process procid_target PID 1852 wrote to memory of 3584 1852 597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe 83 PID 1852 wrote to memory of 3584 1852 597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe 83 PID 1852 wrote to memory of 3584 1852 597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe 83 PID 3584 wrote to memory of 2940 3584 nes97.exe 84 PID 3584 wrote to memory of 2940 3584 nes97.exe 84 PID 3584 wrote to memory of 2940 3584 nes97.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe"C:\Users\Admin\AppData\Local\Temp\597b3f1ee68e7cfc7dbcebd0d4c4a2d149cedd46125b60e227c7ef0673303fcb.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nes97.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nes97.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\btp45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\btp45.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5c783e786ca333204b8e1985f46b0d9d2
SHA1ea589c735cf059471ad3688d2755422ab63ef383
SHA256492678c03a97cca2ac7a99e25e5151750fd19f2d681a2367747d7b8d9e473fd5
SHA512e7da89d8f2aacaeed5a22ed31aadeabdf9dd1aa15f2a27a80d187e6796a09b7467fdaf1ec8bfd34ce2341caac5ecde19d330166e5ee052afcfa115a453161bde
-
Filesize
175KB
MD5da6f3bef8abc85bd09f50783059964e3
SHA1a0f25f60ec1896c4c920ea397f40e6ce29724322
SHA256e6d9ee8ab0ea2ade6e5a9481d8f0f921427ec6919b1b48c6067570fde270736b
SHA5124d2e1472b114c98c74900b8305aabbc49ba28edffdc2376206cf02e26593df4e444933b3aa19f0c6cd0ae3ac3133d656433574aaf25a57748758e5dd25edfbec