Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 11:01

General

  • Target

    17.12.2024 ????????.exe

  • Size

    909KB

  • MD5

    344967abba36524514c992f808adb6c8

  • SHA1

    1d9689bf64b4de90e2dfb4d8df18cfba15420b96

  • SHA256

    b70e02c6c4248dd1af3c6ed70b9e016592ab30f6020e109767cbdf81b8c70b02

  • SHA512

    7abf46fa865417af1e92006101cfbfe1c29ed4c030750db412bf3ef0d924670efdbd5615bed37e0976410b104a9668dfd780e6d0f9fe21f7a233324c213ffe70

  • SSDEEP

    12288:gOMPku+l0CPPOwq0b9XvY3GiNIyqp8Kfy1XYUWoYsaj5Ki2ld53wLgsR0ufYs0yT:WPd+pOpIVANFq+KfydxYsc9o53wcuz

Malware Config

Extracted

Family

redline

Botnet

LOGS

C2

87.120.120.86:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17.12.2024 ________.exe
    "C:\Users\Admin\AppData\Local\Temp\17.12.2024 ________.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\17.12.2024 ________.exe
      "C:\Users\Admin\AppData\Local\Temp\17.12.2024 ________.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1684-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

  • memory/1684-1-0x0000000000800000-0x00000000008E8000-memory.dmp

    Filesize

    928KB

  • memory/1684-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1684-3-0x0000000000750000-0x0000000000776000-memory.dmp

    Filesize

    152KB

  • memory/1684-4-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

  • memory/1684-5-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1684-6-0x0000000000470000-0x0000000000506000-memory.dmp

    Filesize

    600KB

  • memory/1684-19-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1692-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1692-13-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-9-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-15-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-18-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1692-17-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-10-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-8-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-7-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1692-20-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB

  • memory/1692-21-0x0000000074C10000-0x00000000752FE000-memory.dmp

    Filesize

    6.9MB