Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 02:36

General

  • Target

    ca8c14ba60afb39dc26e6ba85b4acb339bc34b1da03f24580f2c7e30b563ce0d.exe

  • Size

    425KB

  • MD5

    5891b6d69ba6c05104ee7c796043717d

  • SHA1

    1c0190c90b36b87133bf0feb5c76c3a8fefea1be

  • SHA256

    ca8c14ba60afb39dc26e6ba85b4acb339bc34b1da03f24580f2c7e30b563ce0d

  • SHA512

    2815e8a6425f205d5328d549c735ba26787c3a9aadc44fa72a6ae71b4aecc76ed4f13ec6005dd0c7273c1cdf83491e1da567901edc273e62f111fc7035d543e2

  • SSDEEP

    6144:Kdy+bnr+Pp0yN90QE1hKyVEzJoA7Flkhwyq1jBGQsq4Jaexqg5dxEUjCl6gyD7oc:bMrPy90ZzVXA7FKjq1KeesWxZvDv

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca8c14ba60afb39dc26e6ba85b4acb339bc34b1da03f24580f2c7e30b563ce0d.exe
    "C:\Users\Admin\AppData\Local\Temp\ca8c14ba60afb39dc26e6ba85b4acb339bc34b1da03f24580f2c7e30b563ce0d.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dLH71.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dLH71.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dLH71.exe

    Filesize

    279KB

    MD5

    6f4ba7e3bbd5b5c19332a451db43f013

    SHA1

    724620092ed22c9e67d0b3582e794af41caee1cd

    SHA256

    7197b7df5d3c14ff9d490409aa1eaa8d2171a01e55e19879350ae4bee22a7f50

    SHA512

    102c23f4b27bbaab2a75a3b27a27643e817fe012d40656a1d597a5078f83986e0fbc700819bfa5888ae6a8fd90b7024f3d8fd9ba2655bfd324e5c99883f30d6f

  • memory/3112-8-0x0000000000920000-0x0000000000A20000-memory.dmp

    Filesize

    1024KB

  • memory/3112-9-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3112-10-0x0000000000400000-0x00000000007A1000-memory.dmp

    Filesize

    3.6MB

  • memory/3112-11-0x0000000000400000-0x00000000007A1000-memory.dmp

    Filesize

    3.6MB

  • memory/3112-12-0x0000000002A00000-0x0000000002A46000-memory.dmp

    Filesize

    280KB

  • memory/3112-13-0x0000000004F30000-0x00000000054D4000-memory.dmp

    Filesize

    5.6MB

  • memory/3112-14-0x0000000002AB0000-0x0000000002AF4000-memory.dmp

    Filesize

    272KB

  • memory/3112-18-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-22-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-78-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-77-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-74-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-73-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-70-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-66-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-64-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-62-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-58-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-56-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-54-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-52-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-50-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-48-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-44-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-42-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-40-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-38-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-36-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-34-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-32-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-30-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-28-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-26-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-20-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-16-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-15-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-68-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-60-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-46-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-24-0x0000000002AB0000-0x0000000002AEE000-memory.dmp

    Filesize

    248KB

  • memory/3112-921-0x00000000054E0000-0x0000000005AF8000-memory.dmp

    Filesize

    6.1MB

  • memory/3112-922-0x0000000005B00000-0x0000000005C0A000-memory.dmp

    Filesize

    1.0MB

  • memory/3112-923-0x0000000002B90000-0x0000000002BA2000-memory.dmp

    Filesize

    72KB

  • memory/3112-924-0x0000000005C10000-0x0000000005C4C000-memory.dmp

    Filesize

    240KB

  • memory/3112-925-0x0000000005D50000-0x0000000005D9C000-memory.dmp

    Filesize

    304KB

  • memory/3112-926-0x0000000000920000-0x0000000000A20000-memory.dmp

    Filesize

    1024KB

  • memory/3112-927-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB