Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 11:00

General

  • Target

    ed94161be05e412bbc756d228e23af65e9b00329a3af64471cb5d87d0d932deb.exe

  • Size

    376KB

  • MD5

    7ab6db8160f105a7f87eddeb491da431

  • SHA1

    59e01e693541b8c355526ae97b36fa94f4bbc5ba

  • SHA256

    ed94161be05e412bbc756d228e23af65e9b00329a3af64471cb5d87d0d932deb

  • SHA512

    e22b332a89a6eb4749e993af39f2df6d3bdae50697a6b79c0488aa1aad3269072d7a4a950d85c546c9f6a0d950b5195702f30b2caf86bc80ca20169b5c10a0c8

  • SSDEEP

    6144:K7y+bnr+Op0yN90QEQet819q/r8SEcGoBT5TZrQb36zytBjmK:5MrGy901219qjJzG/76zytBjF

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed94161be05e412bbc756d228e23af65e9b00329a3af64471cb5d87d0d932deb.exe
    "C:\Users\Admin\AppData\Local\Temp\ed94161be05e412bbc756d228e23af65e9b00329a3af64471cb5d87d0d932deb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3144207.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3144207.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2362005.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2362005.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:664

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3144207.exe

          Filesize

          204KB

          MD5

          7b44eb70515094744f3ddc2196dce439

          SHA1

          6107563379902fd195b9506ee863756f3f6f982f

          SHA256

          f50647a1a7c5956a42e7c64dc728c378867f22f50b25731dc012b1620f376128

          SHA512

          5f9eea400018380c6aea35f6511d747d347810e4abbcbf075eb89452849ea32c883f1714cf3357d1e7244ff0affdb849db43c8a449b6718fa617eebdfcbde1ae

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2362005.exe

          Filesize

          136KB

          MD5

          700f12a0cf80290016ec436cbf1325a4

          SHA1

          b0014ad2c582271450e5987ed30929ea1ebd1f0c

          SHA256

          ac4f7f5d95cef824c563ef4c955be59b77ab421726e4608e7f3bae36f7757499

          SHA512

          3619d5b9a884f5dd3f9c890bf380009b16235a467d68b50ba241d27f52ceeb47a99907ea1ef3944bf4c73f564f3f9931a01ee61f2f57b3ec4a35fafaf1fe089d

        • memory/664-14-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

          Filesize

          4KB

        • memory/664-15-0x0000000000E60000-0x0000000000E88000-memory.dmp

          Filesize

          160KB

        • memory/664-16-0x0000000008110000-0x0000000008728000-memory.dmp

          Filesize

          6.1MB

        • memory/664-17-0x0000000007B80000-0x0000000007B92000-memory.dmp

          Filesize

          72KB

        • memory/664-18-0x0000000007CF0000-0x0000000007DFA000-memory.dmp

          Filesize

          1.0MB

        • memory/664-19-0x0000000007C60000-0x0000000007C9C000-memory.dmp

          Filesize

          240KB

        • memory/664-20-0x0000000073E50000-0x0000000074600000-memory.dmp

          Filesize

          7.7MB

        • memory/664-21-0x0000000002FA0000-0x0000000002FEC000-memory.dmp

          Filesize

          304KB

        • memory/664-22-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

          Filesize

          4KB

        • memory/664-23-0x0000000073E50000-0x0000000074600000-memory.dmp

          Filesize

          7.7MB