Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 04:58

General

  • Target

    da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe

  • Size

    5.3MB

  • MD5

    d4817ea043beaf35d19fa6a5adaa179c

  • SHA1

    bf5c75100142731e737c04b55769c4479bef0c01

  • SHA256

    da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d

  • SHA512

    98d2f67523de2260cad45ce2b3f0e6edd5322ad4d2d78854983c3410398079f1a0dd3f8b3dc69d3e0f052c566de3eb89d1de9a086378f542b1a2096ce0730277

  • SSDEEP

    98304:euP+GgrLRHeOxxsJFoQYVCkOTfOKfKQMZ8htPwCakmxrcTZcV+TQB:l+GgLRJghYckmmKfFMZqtMkicZcV2e

Malware Config

Extracted

Family

redline

Botnet

duc

C2

159.223.34.114:1912

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 6 IoCs
  • Themida packer 15 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe
    "C:\Users\Admin\AppData\Local\Temp\da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3568
    • \??\c:\users\admin\appdata\local\temp\da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe 
      c:\users\admin\appdata\local\temp\da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1588
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2456
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2980
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4052
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5028
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3496

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\da5844b02ebfa56b4c036ea50136e7766922fa1591d344130f5492e5624fdf5d.exe 

    Filesize

    300KB

    MD5

    c368cb0e4cc65cbdc012e449de37d973

    SHA1

    ae04d634ff3078e1912dc71d44c893c1dd47c399

    SHA256

    57a8157689acab60874b086408091b4369f3f5f9d62bcc306c9e77ff9f3c5b7e

    SHA512

    e823a91ee1f8901ebc844d16ed1c585bd78fcf6fa143433649c1295f3724ddd29679949ec7b97485505b259e4ce7d012948f971451f0bde6b525cc915e3ed18a

  • C:\Windows\Resources\Themes\explorer.exe

    Filesize

    5.6MB

    MD5

    bab3b481ba6635c9e00d479b8e0ace2a

    SHA1

    4b890d74e5fe07ce5db13de26930a3685aa81aa0

    SHA256

    74bc92a5905813f9669dc1a1d86716aa702194d36e363ecafdcf099446819823

    SHA512

    daea3dbc0a08e245f9496a579951836e39c9d5c5da9e3694323a7d15e51a974c970ff564a46257e83230913a62a151be7a7c9358585491522e0b55ab75bf4793

  • C:\Windows\Resources\Themes\icsys.icn.exe

    Filesize

    5.0MB

    MD5

    6a696257bd624ea0cdde713ff447b134

    SHA1

    fa17806195d1fb5a2077a7d43827f58832d57c35

    SHA256

    c2234864d3687f6eb397fc0fe4c81d2c54dbcf74161ab38b48a1150df753c573

    SHA512

    b49ac9b20ab4f1c8b7793f1c007ee7985f9c11c0c5c67cf99436f22275efca504a20480a0d6cf52c793060eb78f090a66d33a5f37bffe678591b16a55d7d94ae

  • C:\Windows\Resources\spoolsv.exe

    Filesize

    5.6MB

    MD5

    82d19936483dff0da68b87b51c073659

    SHA1

    e47d7f62f20e98ab4d9d43eb554444e66466412b

    SHA256

    409bc46dbce714a7b7c313c3641676fd8d410762dec33b76fa7f381d6a33f003

    SHA512

    507251da9910f9068870a33d12b757a4dd5b00b97e6fd8907982d6cd124c90f15c29cc5609c59e1323ffcadb2c39e8b80dbd5cc79ac259a5e060681dea0ebada

  • C:\Windows\Resources\svchost.exe

    Filesize

    5.6MB

    MD5

    f1f9bfe0b360b0e567d21b71c48cda91

    SHA1

    a0af13bbd75d92a1432f8dab52d72d91651c3064

    SHA256

    1efa9a7efacd771f4e3d22ad8aef0b39a09231df5b8500fcc812c70bcd96dfda

    SHA512

    5ffcac4c0876af5143dfea1f2ac1cb581c52ef0658eeaeb3eab17e511ab35cba8f4946fbdc50b83b453bfbfd8aea44d9754322decc0cd57bfd52c8ed2261be25

  • memory/1588-14-0x0000000005670000-0x000000000567A000-memory.dmp

    Filesize

    40KB

  • memory/1588-13-0x00000000054A0000-0x0000000005532000-memory.dmp

    Filesize

    584KB

  • memory/1588-10-0x00000000745FE000-0x00000000745FF000-memory.dmp

    Filesize

    4KB

  • memory/1588-15-0x00000000745F0000-0x0000000074DA0000-memory.dmp

    Filesize

    7.7MB

  • memory/1588-16-0x0000000006700000-0x0000000006D18000-memory.dmp

    Filesize

    6.1MB

  • memory/1588-17-0x0000000005820000-0x000000000592A000-memory.dmp

    Filesize

    1.0MB

  • memory/1588-18-0x0000000005750000-0x0000000005762000-memory.dmp

    Filesize

    72KB

  • memory/1588-19-0x00000000057B0000-0x00000000057EC000-memory.dmp

    Filesize

    240KB

  • memory/1588-20-0x0000000005930000-0x000000000597C000-memory.dmp

    Filesize

    304KB

  • memory/1588-11-0x0000000000A60000-0x0000000000AB2000-memory.dmp

    Filesize

    328KB

  • memory/1588-23-0x00000000745FE000-0x00000000745FF000-memory.dmp

    Filesize

    4KB

  • memory/1588-12-0x0000000005B30000-0x00000000060D4000-memory.dmp

    Filesize

    5.6MB

  • memory/1588-27-0x00000000745F0000-0x0000000074DA0000-memory.dmp

    Filesize

    7.7MB

  • memory/2456-28-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/2456-63-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/2980-65-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/2980-79-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/3496-57-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/3496-61-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/3568-21-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/3568-0-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/3568-1-0x0000000077584000-0x0000000077586000-memory.dmp

    Filesize

    8KB

  • memory/3568-64-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/4052-62-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB

  • memory/5028-67-0x0000000000400000-0x0000000000FE2000-memory.dmp

    Filesize

    11.9MB