Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 02:40

General

  • Target

    41855f8fed3914b9976db29c47628413bad748dd99b3cbc28747c1e1faea5d15.exe

  • Size

    440KB

  • MD5

    8197dc1ca5ff44b7783ed34fd2e423e5

  • SHA1

    70808c29191ed8e2e505fd6835d3a4d15a74f8c0

  • SHA256

    41855f8fed3914b9976db29c47628413bad748dd99b3cbc28747c1e1faea5d15

  • SHA512

    1d1a7acd5b8f9dca481516097790bed6364ec41bacea1a639210b0229c6e5b61ff422176f957def813515a36cf092fc9d8b7903713e7b874c7c412f2d9e8223d

  • SSDEEP

    6144:K7y+bnr+sp0yN90QEUg6WNGF1t14ByT8bUDH/MOXs6YbBstt4JXkuFc6Ze:BMrEy90+g6W8F13F/MB6uB/JXkuzZe

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41855f8fed3914b9976db29c47628413bad748dd99b3cbc28747c1e1faea5d15.exe
    "C:\Users\Admin\AppData\Local\Temp\41855f8fed3914b9976db29c47628413bad748dd99b3cbc28747c1e1faea5d15.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nUL85nz.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nUL85nz.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nUL85nz.exe

    Filesize

    314KB

    MD5

    ee84dcb51d989665a64057d90939b788

    SHA1

    b570b336ba7bf97c9a935b5f2b2d5bc3da6246a4

    SHA256

    9ad3d8f666c3a475c30c5a79e35b5b9f68c47a127b80116357112d63494dd7f6

    SHA512

    e1ded20d1376e789b717145dc5d2f3b37f152bfa6feb59760fe067147982f77f5eb3232639f2e47a728ec406e9a68407bdd7e357e6ca510fac36abbfc4318282

  • memory/1708-8-0x0000000000660000-0x0000000000760000-memory.dmp

    Filesize

    1024KB

  • memory/1708-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1708-10-0x0000000000400000-0x0000000000584000-memory.dmp

    Filesize

    1.5MB

  • memory/1708-11-0x0000000000400000-0x0000000000584000-memory.dmp

    Filesize

    1.5MB

  • memory/1708-12-0x0000000004C50000-0x0000000004C96000-memory.dmp

    Filesize

    280KB

  • memory/1708-13-0x0000000004CE0000-0x0000000005284000-memory.dmp

    Filesize

    5.6MB

  • memory/1708-14-0x0000000005290000-0x00000000052D4000-memory.dmp

    Filesize

    272KB

  • memory/1708-78-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-76-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-74-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-72-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-70-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-68-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-66-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-64-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-62-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-60-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-58-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-54-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-52-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-50-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-49-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-44-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-42-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-40-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-38-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-36-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-34-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-32-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-30-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-28-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-24-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-22-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-20-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-19-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-16-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-56-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-46-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-26-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-15-0x0000000005290000-0x00000000052CE000-memory.dmp

    Filesize

    248KB

  • memory/1708-921-0x00000000052F0000-0x0000000005908000-memory.dmp

    Filesize

    6.1MB

  • memory/1708-922-0x0000000005990000-0x0000000005A9A000-memory.dmp

    Filesize

    1.0MB

  • memory/1708-923-0x0000000005AD0000-0x0000000005AE2000-memory.dmp

    Filesize

    72KB

  • memory/1708-924-0x0000000005AF0000-0x0000000005B2C000-memory.dmp

    Filesize

    240KB

  • memory/1708-925-0x0000000005C40000-0x0000000005C8C000-memory.dmp

    Filesize

    304KB

  • memory/1708-926-0x0000000000660000-0x0000000000760000-memory.dmp

    Filesize

    1024KB

  • memory/1708-927-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB