Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 07:02

General

  • Target

    77224290ab3eeed8313c52d360c74b4eadb9bb633c44be186cd9c3347848c336.exe

  • Size

    442KB

  • MD5

    ff1f05e13d87e4a3466a8e477e79cb19

  • SHA1

    bb79cc1d9559baf1fef1b82adf4730609720b23a

  • SHA256

    77224290ab3eeed8313c52d360c74b4eadb9bb633c44be186cd9c3347848c336

  • SHA512

    856404f9877cd18567d7a8bd6bb8e3aefda4c0fc28d1168ada0c3bd1fa99f7b9cb96ea6bc153a4284c3b860d8efd4c20f73e1ab019a86576c53c8a342d815749

  • SSDEEP

    6144:Kxy+bnr+Ap0yN90QEMiEeLKBWtC8J+/9mb1YbUGrWBWaPzcmWljhLELWqasY:rMrAy90ojz8dabLrW4Mm6f5Y

Malware Config

Extracted

Family

redline

Botnet

rodik

C2

193.233.20.23:4124

Attributes
  • auth_value

    59b6e22e7cfd9b5fa0c99d1942f7c85d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77224290ab3eeed8313c52d360c74b4eadb9bb633c44be186cd9c3347848c336.exe
    "C:\Users\Admin\AppData\Local\Temp\77224290ab3eeed8313c52d360c74b4eadb9bb633c44be186cd9c3347848c336.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lsL82un87.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lsL82un87.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lsL82un87.exe

    Filesize

    352KB

    MD5

    d2729c28626365c4f9bb088111d02bfc

    SHA1

    b2534bb2e96f39a85721a2eb50104277991023dd

    SHA256

    eaea35ff058f1e9573ea1cb5cc82f7dd50b0a2421f4286e930ef7b59ec1d6878

    SHA512

    86bb0545015dc66757f090d79cb4a41e4ed72542bb81f2b7149c497ac02c2def976b7ac4e4875c96df31742ec51ed7ac7a16df599d39f4e6e5c2f6679df1c555

  • memory/4028-8-0x0000000002EA0000-0x0000000002FA0000-memory.dmp

    Filesize

    1024KB

  • memory/4028-9-0x0000000004840000-0x000000000488B000-memory.dmp

    Filesize

    300KB

  • memory/4028-10-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4028-11-0x0000000004A70000-0x0000000004AB6000-memory.dmp

    Filesize

    280KB

  • memory/4028-12-0x00000000074B0000-0x0000000007A54000-memory.dmp

    Filesize

    5.6MB

  • memory/4028-13-0x0000000004C30000-0x0000000004C74000-memory.dmp

    Filesize

    272KB

  • memory/4028-14-0x0000000000400000-0x0000000002BB1000-memory.dmp

    Filesize

    39.7MB

  • memory/4028-24-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-27-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-21-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-78-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-76-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-72-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-70-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-69-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-67-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-64-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-62-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-60-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-58-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-54-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-53-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-50-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-48-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-46-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-42-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-40-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-36-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-34-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-32-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-30-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-28-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-22-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-18-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-16-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-74-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-56-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-44-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-38-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-15-0x0000000004C30000-0x0000000004C6F000-memory.dmp

    Filesize

    252KB

  • memory/4028-921-0x0000000007A60000-0x0000000008078000-memory.dmp

    Filesize

    6.1MB

  • memory/4028-922-0x0000000007350000-0x000000000745A000-memory.dmp

    Filesize

    1.0MB

  • memory/4028-923-0x0000000004F90000-0x0000000004FA2000-memory.dmp

    Filesize

    72KB

  • memory/4028-924-0x0000000004FB0000-0x0000000004FEC000-memory.dmp

    Filesize

    240KB

  • memory/4028-925-0x0000000008180000-0x00000000081CC000-memory.dmp

    Filesize

    304KB

  • memory/4028-926-0x0000000002EA0000-0x0000000002FA0000-memory.dmp

    Filesize

    1024KB

  • memory/4028-927-0x0000000004840000-0x000000000488B000-memory.dmp

    Filesize

    300KB

  • memory/4028-929-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB