Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/11/2024, 05:04
General
-
Target
ca292c8429250152bdbf15fcca86800ae6a525f64859969642b3b677c8bb688d.exe
-
Size
590KB
-
MD5
b1329835b326444e658db6a419caaee3
-
SHA1
10a62ebeec3b69ee6af0b91dd3ae3495dfdc6ebc
-
SHA256
ca292c8429250152bdbf15fcca86800ae6a525f64859969642b3b677c8bb688d
-
SHA512
949502e7ecf21fb22682ee63436cde3a11f7509192940a45c8f1efb0a1f4150dfce3f9b8633bbe12bc4b3542367474f5d93636513a45628b9d039fbbafb35348
-
SSDEEP
12288:Iy90HpqUjnn65TLR50wdhPIqYneuuzLsnW3IKL:IysvnCRPdhQqHu6KiLL
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
dante
185.161.248.73:4164
-
auth_value
f4066af6b8a6f23125c8ee48288a3f90
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
-
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca292c8429250152bdbf15fcca86800ae6a525f64859969642b3b677c8bb688d.exe"C:\Users\Admin\AppData\Local\Temp\ca292c8429250152bdbf15fcca86800ae6a525f64859969642b3b677c8bb688d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m58268408.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m58268408.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 13723⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n82318178.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n82318178.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 440 -ip 4401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
530KB
MD5047ddbcf9d11359ffdd50389ef36110e
SHA1770ae7236833a4c1a8a38ad84e90b6e33ef4a8c6
SHA2569047c0a706bed8130a3869f39d407d790ccfbe95e7f505ad323cae74a8f2cec9
SHA5126daa6a3acb98a2df15921f85ebf2957c6c0c828dce6896bc884283832be793539d163d012a8d2c478ca27daa5c76c40dff9fddcfce3586418bfab1238dc90cba
-
Filesize
168KB
MD53f7ebbf8eca49f24476f22a09c81445f
SHA14be6737695f2babb6985f6dce3b46bfab7f0d375
SHA2563476f0bd6bf072b75e9933c7d4164e021a282f4dcbeb80d8948da6469499b3fd
SHA5120c6aace7cda4b4f893ca78911327019c950334c48fb64d891676c52158f69683c202385666918a8a6383a49a4e23ee9599fe7790246c4ca0921c95db4a79bfd0
-
Filesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
Filesize
384KB
-
Filesize
364KB
-
Filesize
416KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
376KB
-
Filesize
6.6MB
-
Filesize
384KB
-
Filesize
1024KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1024KB
-
Filesize
200KB
-
Filesize
384KB
-
Filesize
376KB
-
Filesize
376KB
-
Filesize
384KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
192KB
-
Filesize
24KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
24KB
-
Filesize
7.7MB