Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:02

General

  • Target

    770453ee69ee95d05fceec377716cb2c2b8e267c2219091b5752c58a5b7a3ff4.exe

  • Size

    589KB

  • MD5

    70294e93eea8a460352231e44f36c02c

  • SHA1

    ee6b4cebe25905b2745496a75aa9b08b3dc9779c

  • SHA256

    770453ee69ee95d05fceec377716cb2c2b8e267c2219091b5752c58a5b7a3ff4

  • SHA512

    9b156c1726387fe386578acefa0c0c1f636a1775ccb630d8c565b9512e5a3eb0d688140e19b3f67d23c81d243c1747a77a2632a06c5bbe5d1ca18c30239d696c

  • SSDEEP

    12288:WMrNy90cXjdQfJ0brhtlpx4kCJY7T3vKq:DypXkJ0brh/pOY7TvKq

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\770453ee69ee95d05fceec377716cb2c2b8e267c2219091b5752c58a5b7a3ff4.exe
    "C:\Users\Admin\AppData\Local\Temp\770453ee69ee95d05fceec377716cb2c2b8e267c2219091b5752c58a5b7a3ff4.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4548890.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4548890.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0828639.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0828639.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2376

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4548890.exe

          Filesize

          417KB

          MD5

          46528375980e8cdc8def5c32fb4c46de

          SHA1

          d2481d11be9fed8bb1dbb49d462411fd771270f9

          SHA256

          944b7f4801f730d5d4b676c654c23d1df33ba19e1f8cc5adad6b20c19a0a2bab

          SHA512

          a02afcaa8d18c6dabb8cb75398204b93ab46102e3bbed892a615a172e928bed2d09b8e93c65d2b9f2e7c8f3f6e40bbfebf1bb8987bb5c42db20ce71dc68b84d5

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g0828639.exe

          Filesize

          136KB

          MD5

          7866b019181b680a3c91ac98c03a1554

          SHA1

          8789d9d95d00d7d23772a223b29bdd5a4299df2c

          SHA256

          8e6b2e477ab405351f663e19c5d9a1bdc1acb36586a03f9a70441b57ddac0385

          SHA512

          8b4f2b2827f7c95f5801247752694658131d944341bce63a1f4d0742cabcef9360cda144c01004c4824a1d30bab01f84e032078bfbb6f59ad890619366962033

        • memory/2376-14-0x0000000073E3E000-0x0000000073E3F000-memory.dmp

          Filesize

          4KB

        • memory/2376-15-0x0000000000C60000-0x0000000000C88000-memory.dmp

          Filesize

          160KB

        • memory/2376-16-0x0000000008060000-0x0000000008678000-memory.dmp

          Filesize

          6.1MB

        • memory/2376-17-0x0000000007B00000-0x0000000007B12000-memory.dmp

          Filesize

          72KB

        • memory/2376-18-0x0000000007C30000-0x0000000007D3A000-memory.dmp

          Filesize

          1.0MB

        • memory/2376-19-0x0000000007B60000-0x0000000007B9C000-memory.dmp

          Filesize

          240KB

        • memory/2376-20-0x0000000073E30000-0x00000000745E0000-memory.dmp

          Filesize

          7.7MB

        • memory/2376-21-0x0000000005070000-0x00000000050BC000-memory.dmp

          Filesize

          304KB

        • memory/2376-22-0x0000000073E3E000-0x0000000073E3F000-memory.dmp

          Filesize

          4KB

        • memory/2376-23-0x0000000073E30000-0x00000000745E0000-memory.dmp

          Filesize

          7.7MB