Analysis

  • max time kernel
    109s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:56 UTC

General

  • Target

    6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe

  • Size

    435KB

  • MD5

    641409e8e5cba9035c7a6f6afeec3770

  • SHA1

    898a8b533a37eaa46a3359349011ab0c8f9e3734

  • SHA256

    6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1f

  • SHA512

    5559aa7b9bcf5e7587d8336d2f55ea2fe038704800f50c3bc423d5ec8c6ba01886ca109f2f59838f19e8af95e04fa3a80e162fe63faa08c1c22926f2774d7f15

  • SSDEEP

    12288:ZzcQNw0UZSjBf6KytxYz72p0SzctJM0C:XK0UZSjBwaf2p0E2Mf

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe
    "C:\Users\Admin\AppData\Local\Temp\6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3776
    • C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 1304
      2⤵
      • Program crash
      PID:4608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3776 -ip 3776
    1⤵
      PID:1344

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.211.185.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.211.185.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      208 B
      4
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      23.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      23.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      133.211.185.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      133.211.185.52.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      73.209.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      73.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/3776-21-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-2108-0x00000000005B0000-0x000000000060B000-memory.dmp

      Filesize

      364KB

    • memory/3776-4-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/3776-5-0x00000000025D0000-0x0000000002636000-memory.dmp

      Filesize

      408KB

    • memory/3776-6-0x0000000004EE0000-0x0000000005484000-memory.dmp

      Filesize

      5.6MB

    • memory/3776-7-0x0000000002910000-0x0000000002976000-memory.dmp

      Filesize

      408KB

    • memory/3776-68-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-71-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-69-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-65-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-63-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-61-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-59-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-57-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-55-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-53-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-51-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-49-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-43-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-39-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-37-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-35-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-33-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-29-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-27-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-25-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-3-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3776-2113-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3776-23-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-17-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-13-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-11-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-48-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-45-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-41-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-31-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-15-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-9-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-8-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-2088-0x0000000000650000-0x0000000000750000-memory.dmp

      Filesize

      1024KB

    • memory/3776-2089-0x0000000004E80000-0x0000000004EB2000-memory.dmp

      Filesize

      200KB

    • memory/3776-2-0x00000000005B0000-0x000000000060B000-memory.dmp

      Filesize

      364KB

    • memory/3776-2114-0x0000000000400000-0x00000000004DC000-memory.dmp

      Filesize

      880KB

    • memory/3776-19-0x0000000002910000-0x000000000296F000-memory.dmp

      Filesize

      380KB

    • memory/3776-1-0x0000000000650000-0x0000000000750000-memory.dmp

      Filesize

      1024KB

    • memory/5416-2104-0x0000000004CF0000-0x0000000004CF6000-memory.dmp

      Filesize

      24KB

    • memory/5416-2106-0x0000000004E40000-0x0000000004F4A000-memory.dmp

      Filesize

      1.0MB

    • memory/5416-2107-0x0000000004D50000-0x0000000004D62000-memory.dmp

      Filesize

      72KB

    • memory/5416-2103-0x0000000000420000-0x0000000000450000-memory.dmp

      Filesize

      192KB

    • memory/5416-2109-0x0000000004DB0000-0x0000000004DEC000-memory.dmp

      Filesize

      240KB

    • memory/5416-2110-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    • memory/5416-2111-0x0000000004F50000-0x0000000004F9C000-memory.dmp

      Filesize

      304KB

    • memory/5416-2102-0x00000000750EE000-0x00000000750EF000-memory.dmp

      Filesize

      4KB

    • memory/5416-2105-0x0000000005350000-0x0000000005968000-memory.dmp

      Filesize

      6.1MB

    • memory/5416-2115-0x00000000750EE000-0x00000000750EF000-memory.dmp

      Filesize

      4KB

    • memory/5416-2116-0x00000000750E0000-0x0000000075890000-memory.dmp

      Filesize

      7.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.