Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 06:00
Static task
static1
Behavioral task
behavioral1
Sample
48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe
Resource
win10v2004-20241007-en
General
-
Target
48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe
-
Size
868KB
-
MD5
bc8279eb0a98750e68cdfc4f289dda67
-
SHA1
e6ddf27fdef791fb1e57d5e8aba05f0ccf7b38a5
-
SHA256
48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26
-
SHA512
7b8b1edef99f0865d208ebffb9d6722d14c3823ec4b848785afd22b69704f8b076da008b4301c7e2cde479ba41f90f554003c835c64ff415c7282855db950229
-
SSDEEP
24576:uy2gamKFUm+9EK/qBtRdwPJzxZPv3lZHc:9CmKFUwrLEZ33l
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dark
185.161.248.73:4164
-
auth_value
ae85b01f66afe8770afeed560513fc2d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/4708-2168-0x0000000005790000-0x00000000057C2000-memory.dmp family_redline behavioral1/files/0x00050000000229c7-2174.dat family_redline behavioral1/memory/3656-2181-0x0000000000250000-0x000000000027E000-memory.dmp family_redline behavioral1/files/0x000a000000023b93-2194.dat family_redline behavioral1/memory/5860-2195-0x00000000005B0000-0x00000000005E0000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation p75190820.exe -
Executes dropped EXE 4 IoCs
pid Process 3968 y69413682.exe 4708 p75190820.exe 3656 1.exe 5860 r69417450.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y69413682.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5904 4708 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language r69417450.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language y69413682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language p75190820.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4708 p75190820.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3616 wrote to memory of 3968 3616 48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe 83 PID 3616 wrote to memory of 3968 3616 48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe 83 PID 3616 wrote to memory of 3968 3616 48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe 83 PID 3968 wrote to memory of 4708 3968 y69413682.exe 84 PID 3968 wrote to memory of 4708 3968 y69413682.exe 84 PID 3968 wrote to memory of 4708 3968 y69413682.exe 84 PID 4708 wrote to memory of 3656 4708 p75190820.exe 88 PID 4708 wrote to memory of 3656 4708 p75190820.exe 88 PID 4708 wrote to memory of 3656 4708 p75190820.exe 88 PID 3968 wrote to memory of 5860 3968 y69413682.exe 92 PID 3968 wrote to memory of 5860 3968 y69413682.exe 92 PID 3968 wrote to memory of 5860 3968 y69413682.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe"C:\Users\Admin\AppData\Local\Temp\48eda5b16800569d0df2c7c063bcd7bb7ff117a16522468288825f00d93bef26.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69413682.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y69413682.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p75190820.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p75190820.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 13924⤵
- Program crash
PID:5904
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r69417450.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r69417450.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4708 -ip 47081⤵PID:5728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
578KB
MD50209dbe90b188fa03a8bd57e7e06e57c
SHA126857658ae5c374fab60718104d85c03dcb7559b
SHA256af1e359a1ab69dd27f38c8451db117d5f635353a073293dac151c82a3b014f49
SHA5125da2f35e1d68fc9e8ae6347569e08db66ba029df7e60305bea681aef5d22068a0e3556da2fb206fd0a5fefe68234b2bb88bc32058bee7b8cf994ee05fc1d1327
-
Filesize
580KB
MD5f5965244dceeaecef0fabc3e5d47e262
SHA1da89cb11974ed6e16bdf401b1d98af54f2cda37b
SHA256030a80b3e0a87560d7f5aef2304ba1a12701909bd769cc77e85f2d6d6aa26130
SHA51216ad573fd16862a50cf042ac03943d8a3b832cf6a00218b390a0074678c51da960d082e7180d98169e58bcd235a3b9b72f54f33a56e06ce500b1dbc8b66be6b7
-
Filesize
172KB
MD561a80719acffecf91a05ad1b0b92974a
SHA167855bbb35b33b13d685d045db55a8fa396cb0bc
SHA2563eb6b06035e92390a95541dbc4a28dca14d6413e69fbb68619ce094572724072
SHA51247f003e95a91a47d8fdfb85a2c0e8c922916100790bbed347d66d7739876a54a6311a304104db0ff8d571ee04264378e9454b97c2931898034c710313aca1dae
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf