Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 03:15

General

  • Target

    2189ea87ed9b5d365fe54f2d5114aa843aff00383ac0def9096debef35e53062.exe

  • Size

    890KB

  • MD5

    6990299157c8a47518b0a730c467b4a2

  • SHA1

    01fd91f4d31d5f5e28d53e86e87a68c7cd84bcf9

  • SHA256

    2189ea87ed9b5d365fe54f2d5114aa843aff00383ac0def9096debef35e53062

  • SHA512

    7f364f723cb18a29907480acd566578de92d208e4c316801c3d64b53ee2a1371df9a1d1f3708a7314ded6d7637083d5bdf3de43df044fa4c41b6e2087f116825

  • SSDEEP

    24576:5yCHTGxneRVOn6nFTaYIneZRgwxqiew3Cmxu/:scyxeivYRdx3e6Cmx

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Extracted

Family

redline

Botnet

dante

C2

185.161.248.73:4164

Attributes
  • auth_value

    f4066af6b8a6f23125c8ee48288a3f90

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2189ea87ed9b5d365fe54f2d5114aa843aff00383ac0def9096debef35e53062.exe
    "C:\Users\Admin\AppData\Local\Temp\2189ea87ed9b5d365fe54f2d5114aa843aff00383ac0def9096debef35e53062.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y36968831.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y36968831.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p93897774.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p93897774.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2256
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1380
          4⤵
          • Program crash
          PID:5548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68921234.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68921234.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:900
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1672 -ip 1672
    1⤵
      PID:5376

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y36968831.exe

      Filesize

      590KB

      MD5

      fbd766788a370e7914d0851baf08c0b1

      SHA1

      1a71ef4e58ce71653299859939b46bdc7e5f3dc6

      SHA256

      657c200d87571801d29e3be43473164279567d231b2f7c4b211a75fbadd22acc

      SHA512

      b54bc72fc7389325aaec9e082b77e187d89902d325ee1f78376c2effb0b1bfa92cb6e960af24f97401cc6662fd5dcc5fcf05575fc0b38ae1c2cab45cf8a0a523

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p93897774.exe

      Filesize

      530KB

      MD5

      fb8539f0ffc5acff08f02412adc316ae

      SHA1

      1a7f3a4dcbbd2ecdc03b520a3ab35952214ad24c

      SHA256

      b55aa2620b9ff1873427a07e239d5ef9c2c7e0cfdc31d7f2a9758b5ebed41685

      SHA512

      356b23f741ca6c1a98f8715d775bbb46e8fa92e269f1c863c6dc4db7a85f7830592e35719704d76b83698e2df721d77f31e85d0331a8314a0473d2d0541d0ad3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r68921234.exe

      Filesize

      168KB

      MD5

      fda8b18e022740f88c4c10a893f97365

      SHA1

      92da7e742ede801f8c406be75c2405112fcf456a

      SHA256

      3bbc1270fae755a643709e2b5c7890dd09f77324f13e82681882d685d580722c

      SHA512

      70acbf5ee9dfb31028a476b1ec418dbb9bdbbabd0627c8106ad85aeba99107d91e7a3d4282c0eca7e913e8d7d1fccd052629bfd9af45cdd3fd72e3f4f6358506

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/900-2197-0x0000000000960000-0x0000000000966000-memory.dmp

      Filesize

      24KB

    • memory/900-2196-0x00000000001F0000-0x0000000000220000-memory.dmp

      Filesize

      192KB

    • memory/1672-49-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-20-0x0000000005230000-0x00000000057D4000-memory.dmp

      Filesize

      5.6MB

    • memory/1672-19-0x0000000002BD0000-0x0000000002C38000-memory.dmp

      Filesize

      416KB

    • memory/1672-37-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-39-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-23-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-83-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-85-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-79-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-77-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-75-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-73-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-71-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-69-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-67-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-65-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-63-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-61-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-57-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-55-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-53-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-51-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-15-0x0000000000BF0000-0x0000000000CF0000-memory.dmp

      Filesize

      1024KB

    • memory/1672-45-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-43-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-21-0x0000000002C70000-0x0000000002CD6000-memory.dmp

      Filesize

      408KB

    • memory/1672-18-0x0000000000400000-0x0000000000A95000-memory.dmp

      Filesize

      6.6MB

    • memory/1672-35-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-33-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-31-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-29-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-27-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-25-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-22-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-81-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-59-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-47-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-41-0x0000000002C70000-0x0000000002CD0000-memory.dmp

      Filesize

      384KB

    • memory/1672-2168-0x0000000000BF0000-0x0000000000CF0000-memory.dmp

      Filesize

      1024KB

    • memory/1672-2169-0x00000000059C0000-0x00000000059F2000-memory.dmp

      Filesize

      200KB

    • memory/1672-2190-0x0000000000B60000-0x0000000000BBB000-memory.dmp

      Filesize

      364KB

    • memory/1672-2192-0x0000000000400000-0x0000000000A95000-memory.dmp

      Filesize

      6.6MB

    • memory/1672-2191-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1672-17-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1672-16-0x0000000000B60000-0x0000000000BBB000-memory.dmp

      Filesize

      364KB

    • memory/2256-2184-0x0000000005020000-0x0000000005638000-memory.dmp

      Filesize

      6.1MB

    • memory/2256-2183-0x00000000008D0000-0x00000000008D6000-memory.dmp

      Filesize

      24KB

    • memory/2256-2182-0x0000000000030000-0x000000000005E000-memory.dmp

      Filesize

      184KB

    • memory/2256-2185-0x0000000004B10000-0x0000000004C1A000-memory.dmp

      Filesize

      1.0MB

    • memory/2256-2186-0x00000000049A0000-0x00000000049B2000-memory.dmp

      Filesize

      72KB

    • memory/2256-2187-0x0000000004A40000-0x0000000004A7C000-memory.dmp

      Filesize

      240KB

    • memory/2256-2188-0x0000000004A80000-0x0000000004ACC000-memory.dmp

      Filesize

      304KB