Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2024 03:38
Static task
static1
Behavioral task
behavioral1
Sample
685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe
Resource
win10v2004-20241007-en
General
-
Target
685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe
-
Size
774KB
-
MD5
ed640888bd8d789a8a7f927cbb49128e
-
SHA1
ba37ca70106f81b4395e707cd09ce2424096598b
-
SHA256
685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028
-
SHA512
fae60eaddb63f1186a255b83ef0f3c696c0052c435d6eaebe19a820c460380525a27335e635623af12a9289a5b85d9d734502e85c92565d2262e59db32eb82dd
-
SSDEEP
12288:5y90CRBr6HsH3YF9DMUzEAlXgexJBkseUWkLyxs2EY/7b4JKkdT4jUzimyOSu3:5y7r6VXMwxxrCsOjbNkMqSu3
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/3452-2168-0x0000000005630000-0x0000000005662000-memory.dmp family_redline behavioral1/files/0x000b000000023b3d-2173.dat family_redline behavioral1/memory/3032-2181-0x00000000008E0000-0x000000000090E000-memory.dmp family_redline behavioral1/files/0x000a000000023b43-2193.dat family_redline behavioral1/memory/3144-2194-0x0000000000850000-0x0000000000880000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation m16546082.exe -
Executes dropped EXE 4 IoCs
pid Process 1120 x61981048.exe 3452 m16546082.exe 3032 1.exe 3144 n19859899.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x61981048.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5400 3452 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x61981048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m16546082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language n19859899.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3452 m16546082.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4208 wrote to memory of 1120 4208 685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe 83 PID 4208 wrote to memory of 1120 4208 685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe 83 PID 4208 wrote to memory of 1120 4208 685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe 83 PID 1120 wrote to memory of 3452 1120 x61981048.exe 84 PID 1120 wrote to memory of 3452 1120 x61981048.exe 84 PID 1120 wrote to memory of 3452 1120 x61981048.exe 84 PID 3452 wrote to memory of 3032 3452 m16546082.exe 88 PID 3452 wrote to memory of 3032 3452 m16546082.exe 88 PID 3452 wrote to memory of 3032 3452 m16546082.exe 88 PID 1120 wrote to memory of 3144 1120 x61981048.exe 92 PID 1120 wrote to memory of 3144 1120 x61981048.exe 92 PID 1120 wrote to memory of 3144 1120 x61981048.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe"C:\Users\Admin\AppData\Local\Temp\685ab137017eb5bccde5dea2464ea02aa7b52c40de67c2a693009201e94f5028.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x61981048.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x61981048.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m16546082.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m16546082.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 13804⤵
- Program crash
PID:5400
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n19859899.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n19859899.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3144
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3452 -ip 34521⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
570KB
MD589ae7d107ed6ee4ffc9514518ac12468
SHA13e8111f6138a93f394d74c3170b25d7ba32d2818
SHA256fceb18f7de922d8d445a172995ef8acb9f2283ec1ece5f1343a0f381f1fb067b
SHA5120ecfd79127b40ea445c0f35251c0cdf851e4c112fe53140616cb00b0a1ef0b145cc30166b7e904b4ee459e5bc0d2f9e6190882b1bd2a3073cc0d45746b82abd0
-
Filesize
479KB
MD5ac2ea183a7a9338e80eac2753bec486f
SHA11de848423e0755baa83cba4a0390d0cd517e8844
SHA2562520e1e995f89b0564687733ffd30b8d299705ff8b29eb8a48926762857b53b8
SHA512eed214401c63c8e171f1e36cd8c77d33886a77e00734f060a4d4e0d7cc14fedb7b882e40bff2941f0f02621bdccb4ce04a4af597f6436b97044e701b1579d0da
-
Filesize
169KB
MD5bafa1a7ad7c1488e2f84f32e143da03d
SHA1bb5ef3e1615c7e40edbe28d645ddab2ade8cc8b7
SHA256213ff6a762c6266ccf61e430dc8b5e72825cfcbd82a1b6fef14cd72d7875c569
SHA512abe163f26738f40a2f2e30e18f3140a92fd86d22e186729c9e089c396abdb57536f5169cc03fa089dea586a7a820f8289b3b0d5fef01c7a0cf2b5dd524987414
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf