Analysis
-
max time kernel
112s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-11-2024 21:29
General
-
Target
71755ae51474a09384d6b13af0b47216a14feabf1435f813249d04c4ed665040N.exe
-
Size
547KB
-
MD5
5d0384075b3efcd9a4f1c150ca823b60
-
SHA1
fdab932754759172e3512c019d454dc489e12c84
-
SHA256
71755ae51474a09384d6b13af0b47216a14feabf1435f813249d04c4ed665040
-
SHA512
92241fe461f797b1226502a7efed7e77e0f391adc70d9be85343f5ffe074395e6e1c84ddfd865a5b83d662bfc71e4d3670556bb9d05beddfdcb2333ef695a84f
-
SSDEEP
6144:vw+yBAWpGb8faYy+cJB3uapBImauFe3poxaejKkELno4qiTkMhWEg9/S5TXVBUw6:I+GAW1faYyFBhFe2ODo2kUg9/Kst
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71755ae51474a09384d6b13af0b47216a14feabf1435f813249d04c4ed665040N.exe"C:\Users\Admin\AppData\Local\Temp\71755ae51474a09384d6b13af0b47216a14feabf1435f813249d04c4ed665040N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 13042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 180 -ip 1801⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD56b4ad9c773e164effa4804bf294831a7
SHA16a0bfcfaf73aff765b7d515f2527773df326f2cc
SHA256967d69ee61666a88719486692c18ba56a85516035b6b7dacfde589417d3b5c85
SHA512accbdf423c36f8d688adeccfc683c6ac5ab983f6f5461554a1cdbfcd8dfb9cf29bfe75cdf6755dd70fa5c29f0fda4a2119f468dd0c42d80c8d0b0aee1a2137d8
-
Filesize
388KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
416KB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
380KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
1024KB
-
Filesize
168KB
-
Filesize
368KB
-
Filesize
1024KB
-
Filesize
380KB
-
Filesize
368KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
160KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB