Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 02:57

General

  • Target

    60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648.exe

  • Size

    310KB

  • MD5

    1f4b0637137572a1fb34aaa033149506

  • SHA1

    c209c9a60a752bc7980a3d9d53daf4b4b32973a9

  • SHA256

    60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648

  • SHA512

    4fd27293437b8bf77d15d993da2b0e75c9fba93bd5f94dad439a3e2e4c16c444f6a32543271f1d2ad79c220354b23301e544765ca392fc156267a89338452e86

  • SSDEEP

    6144:Zm1G61auNh8PDtyJvsHP+iVQmoc2RZ4cm++pBESrvD6ClOC:6GaxO5rHPkmojzAr6C8

Malware Config

Extracted

Family

redline

Botnet

TG@CVV88888

C2

185.218.125.157:21441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648.exe
    "C:\Users\Admin\AppData\Local\Temp\60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:3024
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:3068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tmp6CA4.tmp

      Filesize

      2KB

      MD5

      1420d30f964eac2c85b2ccfe968eebce

      SHA1

      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

      SHA256

      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

      SHA512

      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

    • memory/1600-1-0x0000000000BC0000-0x0000000000C14000-memory.dmp

      Filesize

      336KB

    • memory/1600-36-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1600-5-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1600-0-0x0000000074DFE000-0x0000000074DFF000-memory.dmp

      Filesize

      4KB

    • memory/3068-27-0x00000000066C0000-0x00000000066DE000-memory.dmp

      Filesize

      120KB

    • memory/3068-30-0x0000000006D00000-0x0000000007318000-memory.dmp

      Filesize

      6.1MB

    • memory/3068-9-0x0000000005190000-0x000000000519A000-memory.dmp

      Filesize

      40KB

    • memory/3068-7-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3068-26-0x0000000005F30000-0x0000000005FA6000-memory.dmp

      Filesize

      472KB

    • memory/3068-6-0x0000000005800000-0x0000000005DA4000-memory.dmp

      Filesize

      5.6MB

    • memory/3068-31-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3068-8-0x00000000051A0000-0x0000000005232000-memory.dmp

      Filesize

      584KB

    • memory/3068-32-0x0000000006850000-0x000000000695A000-memory.dmp

      Filesize

      1.0MB

    • memory/3068-33-0x0000000006790000-0x00000000067A2000-memory.dmp

      Filesize

      72KB

    • memory/3068-34-0x00000000067F0000-0x000000000682C000-memory.dmp

      Filesize

      240KB

    • memory/3068-35-0x0000000006960000-0x00000000069AC000-memory.dmp

      Filesize

      304KB

    • memory/3068-3-0x0000000000400000-0x0000000000450000-memory.dmp

      Filesize

      320KB

    • memory/3068-37-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3068-38-0x0000000074DF0000-0x00000000755A0000-memory.dmp

      Filesize

      7.7MB