Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 16:11

General

  • Target

    688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86.exe

  • Size

    3.8MB

  • MD5

    61cdf7e4eca424c763178c94c7ef760f

  • SHA1

    f2096fd54988dbf5a8a9dab58bbd2f919661c5ab

  • SHA256

    688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86

  • SHA512

    6eb87a0bc294d6e4920fc82e9ae2ec397f2a3e31fde8a03644f21216e91aa27148b99e5ae8c92ef9a930ec20c9306a97b33e316fb8b8b981cde9a5df10920812

  • SSDEEP

    98304:nyBQbqAIBax9N1kCvwYxgAmZtd6xcN2QBYMYhRkbp97:nyIioXwYOAgd6KX9Y/y3

Malware Config

Extracted

Family

redline

C2

91.243.32.73:7171

Attributes
  • auth_value

    f0eaa7ad30bc41521e3d61c8504e5715

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86.exe
    "C:\Users\Admin\AppData\Local\Temp\688851b3d020213958e978a00a32113326d2ee66a6bfc5cceb279e393da2ea86.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Local\Temp\F1gaSebe_crypted.exe
      C:\Users\Admin\AppData\Local\Temp\F1gaSebe_crypted.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1020
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        #cmd
        3⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
    • C:\Users\Admin\AppData\Local\Temp\Shortfalls.exe
      C:\Users\Admin\AppData\Local\Temp\Shortfalls.exe
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\F1gaSebe_crypted.exe

    Filesize

    807KB

    MD5

    5f6b473388665e4c29cf86b97acd05f0

    SHA1

    6cc67923b21ef5df391b211243e9bca3f47851dc

    SHA256

    616ceb62d1c53a9837635e51abd73b8c717a9d20b1cc882d1420a46c385d8304

    SHA512

    de3253a8714558da0621dbfcf72e4bceeed563785158f2830061f54d6b14b6a1eeb5d7abf349b9566ebcbb38afc4a0f8757ef94eae58e4eea578a98b4633fd66

  • C:\Users\Admin\AppData\Local\Temp\Shortfalls.exe

    Filesize

    3.6MB

    MD5

    1b8ae5c577608b9f780b3ad704679e0a

    SHA1

    4402007d8e5ca59fe704d543a417c77e39dce762

    SHA256

    039a6fd68c38bd081e9bca0181187df2653e501b5795d24ad6f895cf81c50bdf

    SHA512

    9cc97013331ef3d4fbce1d1656ee5a28c193a50eabbf8fd75f2f1a8c57c00d2b32f82bdb35896209e3d7e24babfed607656b6e4a11a910fa099fbc25340587b3

  • memory/1020-14-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB

  • memory/1020-5-0x00007FFE30A13000-0x00007FFE30A15000-memory.dmp

    Filesize

    8KB

  • memory/1020-6-0x0000000000910000-0x00000000009DE000-memory.dmp

    Filesize

    824KB

  • memory/1020-10-0x000000001B500000-0x000000001B576000-memory.dmp

    Filesize

    472KB

  • memory/1020-11-0x000000001B480000-0x000000001B49E000-memory.dmp

    Filesize

    120KB

  • memory/1020-20-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB

  • memory/1116-25-0x00000000056A0000-0x00000000056DC000-memory.dmp

    Filesize

    240KB

  • memory/1116-22-0x0000000005220000-0x0000000005232000-memory.dmp

    Filesize

    72KB

  • memory/1116-26-0x0000000006520000-0x000000000656C000-memory.dmp

    Filesize

    304KB

  • memory/1116-24-0x00000000052B0000-0x0000000005316000-memory.dmp

    Filesize

    408KB

  • memory/1116-18-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/1116-23-0x0000000005350000-0x000000000545A000-memory.dmp

    Filesize

    1.0MB

  • memory/1116-21-0x0000000005780000-0x0000000005D98000-memory.dmp

    Filesize

    6.1MB

  • memory/4676-13-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB

  • memory/4676-15-0x000001A05EFF0000-0x000001A05F2DE000-memory.dmp

    Filesize

    2.9MB

  • memory/4676-17-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB

  • memory/4676-12-0x000001A044770000-0x000001A044B08000-memory.dmp

    Filesize

    3.6MB

  • memory/4676-16-0x000001A05EEA0000-0x000001A05EEB2000-memory.dmp

    Filesize

    72KB

  • memory/4676-27-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB

  • memory/4676-28-0x000001A064720000-0x000001A064A02000-memory.dmp

    Filesize

    2.9MB

  • memory/4676-29-0x000001A064B50000-0x000001A064D56000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-30-0x000001A064A20000-0x000001A064A32000-memory.dmp

    Filesize

    72KB

  • memory/4676-31-0x000001A0655C0000-0x000001A065A8C000-memory.dmp

    Filesize

    4.8MB

  • memory/4676-33-0x00007FFE30A10000-0x00007FFE314D1000-memory.dmp

    Filesize

    10.8MB