Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:52

General

  • Target

    ad1e6ac46401d151f00297931089ca65a1ab931461390549dfe90c99fe82b119.exe

  • Size

    488KB

  • MD5

    05948601b504afed74cd9ef32f1c757b

  • SHA1

    318f9a04cd21a7f5f47a2fb7bb2d13fe385fb14d

  • SHA256

    ad1e6ac46401d151f00297931089ca65a1ab931461390549dfe90c99fe82b119

  • SHA512

    632f74c2d9f0ef1812fb139a7f3325c8187e5690c26df5ab77e2844832059a35116271d3e803edde7f16e18ab1a38f7a0214c597bcf82bd3a4fe8fd8e4237569

  • SSDEEP

    12288:5Mrdy90bIBggQgHNHqfREq7vK9oayvJ5Iph:sy1hQgHphyK9oaGJqn

Malware Config

Extracted

Family

redline

Botnet

mauga

C2

217.196.96.102:4132

Attributes
  • auth_value

    36f5411cf117f54076fbbb9ea0631fee

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad1e6ac46401d151f00297931089ca65a1ab931461390549dfe90c99fe82b119.exe
    "C:\Users\Admin\AppData\Local\Temp\ad1e6ac46401d151f00297931089ca65a1ab931461390549dfe90c99fe82b119.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3021075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3021075.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3578482.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3578482.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2965018.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2965018.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2636

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3021075.exe

          Filesize

          316KB

          MD5

          fb257522a110895db1c9cf5b0e1ed15b

          SHA1

          849ea92a3d081a8572fb03fcccce025aca82fbeb

          SHA256

          d17f09d4e37c14b6fa7dbdc98549be946cde78ff0216fc73285b354dc193b735

          SHA512

          06654526f40a8b3660f5c562f0a05442b4781bb9528f0b536c10902c728a493f6ca191c922a201feea81af421cbda6ef17d07855ba3eaa159cf96f282136a211

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a3578482.exe

          Filesize

          184KB

          MD5

          567c0f0e4bf3b7c19166b07da544d803

          SHA1

          f5fab8800e13f57dd74d9580b345f95137703633

          SHA256

          b38ff8c318003f20558995ea912dc6f0a8a80cc18eaeda1172541fcca71e05f5

          SHA512

          5dc6d3528f0c51b77f80209f46a933a071a050952e37e45aec4cc4f83663dd1f657ab629b18ed7a3a288a6f669cf57f74db26e308634aecd75fbd130c142fe59

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2965018.exe

          Filesize

          168KB

          MD5

          782f46bb09df52f1a8f7a6ccab5db249

          SHA1

          b3bbdfb36b563ee31174968b5f40e8171f6a025c

          SHA256

          a5b596ab91ddb9ba1aa69c14e5b6851ee650161416702529378dd2e7546981ca

          SHA512

          34829cc10dbb63d0f94775bcfaa5ceef9e7905549ba30f01e91fcbd3105566b18e1dd7811074cefe9d7ff0f3be7c43a388b178a8d63810d4a15645159b21db45

        • memory/2636-62-0x0000000004C70000-0x0000000004CBC000-memory.dmp

          Filesize

          304KB

        • memory/2636-61-0x0000000004AE0000-0x0000000004B1C000-memory.dmp

          Filesize

          240KB

        • memory/2636-60-0x0000000004A80000-0x0000000004A92000-memory.dmp

          Filesize

          72KB

        • memory/2636-59-0x0000000004B60000-0x0000000004C6A000-memory.dmp

          Filesize

          1.0MB

        • memory/2636-58-0x0000000005070000-0x0000000005688000-memory.dmp

          Filesize

          6.1MB

        • memory/2636-57-0x00000000023D0000-0x00000000023D6000-memory.dmp

          Filesize

          24KB

        • memory/2636-56-0x0000000000100000-0x000000000012E000-memory.dmp

          Filesize

          184KB

        • memory/4972-34-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-21-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-44-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-42-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-40-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-36-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-48-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-32-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-30-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-28-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-26-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-24-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-22-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-46-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-49-0x00000000749CE000-0x00000000749CF000-memory.dmp

          Filesize

          4KB

        • memory/4972-50-0x00000000749C0000-0x0000000075170000-memory.dmp

          Filesize

          7.7MB

        • memory/4972-52-0x00000000749C0000-0x0000000075170000-memory.dmp

          Filesize

          7.7MB

        • memory/4972-38-0x0000000004990000-0x00000000049A6000-memory.dmp

          Filesize

          88KB

        • memory/4972-20-0x00000000749C0000-0x0000000075170000-memory.dmp

          Filesize

          7.7MB

        • memory/4972-19-0x00000000749C0000-0x0000000075170000-memory.dmp

          Filesize

          7.7MB

        • memory/4972-18-0x0000000004990000-0x00000000049AC000-memory.dmp

          Filesize

          112KB

        • memory/4972-17-0x0000000004AC0000-0x0000000005064000-memory.dmp

          Filesize

          5.6MB

        • memory/4972-16-0x00000000749C0000-0x0000000075170000-memory.dmp

          Filesize

          7.7MB

        • memory/4972-15-0x00000000021B0000-0x00000000021CE000-memory.dmp

          Filesize

          120KB

        • memory/4972-14-0x00000000749CE000-0x00000000749CF000-memory.dmp

          Filesize

          4KB