Overview

overview

10

Static

static

10

7b6730ca4d...15.exe

windows7-x64

10

7b6730ca4d...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 06:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b6730ca4da283a35c41b831b9567f15.exe

  • Size

    300KB

  • MD5

    7b6730ca4da283a35c41b831b9567f15

  • SHA1

    92ef2fd33f713d72207209ec65f0de6eef395af5

  • SHA256

    94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c

  • SHA512

    ae2d10f9895e5f2af10b4fa87cdb7c930a531e910b55cd752b15dac77a432cc28eca6e5b32b95eeb21e238aaf2eb57e29474660cae93e734d0b6543c1d462ace

  • SSDEEP

    3072:acZqf7D34kp/0+mA0kywMlQEg85fB1fA0PuTVAtkxzy3RMeqiOL2bBOA:acZqf7DIcnGCQNB1fA0GTV8kU0L

Score
10/10
redlineeewxdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

eewx

C2

185.81.68.147:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b6730ca4da283a35c41b831b9567f15.exe
    "C:\Users\Admin\AppData\Local\Temp\7b6730ca4da283a35c41b831b9567f15.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4872

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    147.68.81.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    147.68.81.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • 185.81.68.147:1912
    7b6730ca4da283a35c41b831b9567f15.exe
    525.4kB
     21.2kB
     409
    160
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    147.68.81.185.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    147.68.81.185.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    142 B
     157 B
     2
    1

    DNS Request

    13.86.106.20.in-addr.arpa

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4872-0-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4872-1-0x0000000000670000-0x00000000006C2000-memory.dmp

    Filesize

    328KB

    Download

  • memory/4872-2-0x0000000005640000-0x0000000005BE4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4872-3-0x0000000005130000-0x00000000051C2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4872-4-0x00000000050E0000-0x00000000050EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4872-5-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4872-6-0x0000000006210000-0x0000000006828000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/4872-7-0x0000000005BF0000-0x0000000005CFA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/4872-8-0x0000000005250000-0x0000000005262000-memory.dmp

    Filesize

    72KB

    Download

  • memory/4872-9-0x00000000052F0000-0x000000000532C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4872-10-0x0000000005470000-0x00000000054BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4872-11-0x00000000055B0000-0x0000000005616000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4872-12-0x0000000006BC0000-0x0000000006C10000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4872-13-0x0000000006DE0000-0x0000000006FA2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/4872-14-0x00000000074E0000-0x0000000007A0C000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/4872-15-0x000000007506E000-0x000000007506F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4872-16-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4872-18-0x0000000075060000-0x0000000075810000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.