Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 23:15

General

  • Target

    474a06852b1fa4892e3cdba9f44adb81b61bbaaff8684cc206698b96c22a6b63.exe

  • Size

    426KB

  • MD5

    58feec2b84cd62a3f94b185570d97601

  • SHA1

    baca655934e20d04e0bbbd72135b7e39c5267b08

  • SHA256

    474a06852b1fa4892e3cdba9f44adb81b61bbaaff8684cc206698b96c22a6b63

  • SHA512

    aafbf7f94b2000aa9114e760b43f80824e7032da8d9b0fd88a8c0eb9ac0a125bff7795620fb9f9647376c205370e48d3759765f3ff54c524d3c7083a342e5903

  • SSDEEP

    12288:R7vQMcmljqOWJFwMi4haxwYd/1Li6NFh4m:Z4MFle7JU4QhNcm

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\474a06852b1fa4892e3cdba9f44adb81b61bbaaff8684cc206698b96c22a6b63.exe
    "C:\Users\Admin\AppData\Local\Temp\474a06852b1fa4892e3cdba9f44adb81b61bbaaff8684cc206698b96c22a6b63.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:9100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    1073b2e7f778788852d3f7bb79929882

    SHA1

    7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

    SHA256

    c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

    SHA512

    90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

  • memory/1736-1-0x00000000005D0000-0x00000000006D0000-memory.dmp

    Filesize

    1024KB

  • memory/1736-2-0x0000000000220000-0x000000000027B000-memory.dmp

    Filesize

    364KB

  • memory/1736-3-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1736-4-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1736-5-0x00000000049E0000-0x0000000004A46000-memory.dmp

    Filesize

    408KB

  • memory/1736-6-0x0000000002360000-0x00000000023C6000-memory.dmp

    Filesize

    408KB

  • memory/1736-7-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-8-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-14-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-12-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-10-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-44-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-50-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-64-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-48-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-46-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-42-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-40-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-38-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-36-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-34-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-32-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-30-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-28-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-26-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-24-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-22-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-20-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-18-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-16-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-70-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-68-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-66-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-62-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-60-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-58-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-56-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-54-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-52-0x0000000002360000-0x00000000023BF000-memory.dmp

    Filesize

    380KB

  • memory/1736-2087-0x00000000005D0000-0x00000000006D0000-memory.dmp

    Filesize

    1024KB

  • memory/1736-2088-0x0000000002500000-0x0000000002532000-memory.dmp

    Filesize

    200KB

  • memory/1736-2098-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1736-2097-0x0000000000220000-0x000000000027B000-memory.dmp

    Filesize

    364KB

  • memory/1736-2099-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/9100-2101-0x00000000009E0000-0x0000000000A10000-memory.dmp

    Filesize

    192KB

  • memory/9100-2100-0x000000007413E000-0x000000007413F000-memory.dmp

    Filesize

    4KB

  • memory/9100-2102-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB

  • memory/9100-2103-0x0000000074130000-0x000000007481E000-memory.dmp

    Filesize

    6.9MB

  • memory/9100-2104-0x000000007413E000-0x000000007413F000-memory.dmp

    Filesize

    4KB

  • memory/9100-2105-0x0000000074130000-0x000000007481E000-memory.dmp

    Filesize

    6.9MB