Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 12:00

General

  • Target

    94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c.exe

  • Size

    300KB

  • MD5

    7b6730ca4da283a35c41b831b9567f15

  • SHA1

    92ef2fd33f713d72207209ec65f0de6eef395af5

  • SHA256

    94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c

  • SHA512

    ae2d10f9895e5f2af10b4fa87cdb7c930a531e910b55cd752b15dac77a432cc28eca6e5b32b95eeb21e238aaf2eb57e29474660cae93e734d0b6543c1d462ace

  • SSDEEP

    3072:acZqf7D34kp/0+mA0kywMlQEg85fB1fA0PuTVAtkxzy3RMeqiOL2bBOA:acZqf7DIcnGCQNB1fA0GTV8kU0L

Malware Config

Extracted

Family

redline

Botnet

eewx

C2

185.81.68.147:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c.exe
    "C:\Users\Admin\AppData\Local\Temp\94d7d12ae53ce97f38d8890383c2317ce03d45bd6ecaf0e0b9165c7066cd300c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4448-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

    Filesize

    4KB

  • memory/4448-1-0x0000000000F10000-0x0000000000F62000-memory.dmp

    Filesize

    328KB

  • memory/4448-2-0x0000000005E20000-0x00000000063C4000-memory.dmp

    Filesize

    5.6MB

  • memory/4448-3-0x0000000005870000-0x0000000005902000-memory.dmp

    Filesize

    584KB

  • memory/4448-4-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-5-0x0000000005830000-0x000000000583A000-memory.dmp

    Filesize

    40KB

  • memory/4448-6-0x00000000069F0000-0x0000000007008000-memory.dmp

    Filesize

    6.1MB

  • memory/4448-7-0x0000000005BD0000-0x0000000005CDA000-memory.dmp

    Filesize

    1.0MB

  • memory/4448-8-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

    Filesize

    72KB

  • memory/4448-9-0x0000000005B10000-0x0000000005B4C000-memory.dmp

    Filesize

    240KB

  • memory/4448-10-0x0000000005B60000-0x0000000005BAC000-memory.dmp

    Filesize

    304KB

  • memory/4448-11-0x00000000064D0000-0x0000000006536000-memory.dmp

    Filesize

    408KB

  • memory/4448-12-0x00000000075E0000-0x00000000077A2000-memory.dmp

    Filesize

    1.8MB

  • memory/4448-13-0x0000000007CE0000-0x000000000820C000-memory.dmp

    Filesize

    5.2MB

  • memory/4448-14-0x0000000007550000-0x00000000075A0000-memory.dmp

    Filesize

    320KB

  • memory/4448-15-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

    Filesize

    4KB

  • memory/4448-16-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB

  • memory/4448-18-0x0000000074DF0000-0x00000000755A0000-memory.dmp

    Filesize

    7.7MB