Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
09-05-2024 04:31
General
-
Target
2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1.exe
-
Size
267KB
-
MD5
ef9ca70006456b5454a91555a50f9838
-
SHA1
75721a16ad42f6494479ff6be2527b76af41c5d6
-
SHA256
2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1
-
SHA512
c432b80d2e5392c6b6117178544943b907ea7e0ebf74c87a0bd28f51cf3c84feaf4c22fea2d9533288fe7585a85d5cd921707df5208049d667145866e0ca4253
-
SSDEEP
6144:4YcllhS4qdxjPxUUsOhETPDJtNJEQcwbOFRcmmKU:na/SNRqJtf/cOsEKU
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
5345987420
C2
https://pastebin.com/raw/KE5Mft0T
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1.exe"C:\Users\Admin\AppData\Local\Temp\2fef5824862e6a49e4ccc50a4a2a852a593376f7ea95f715530f943ba49fe6f1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB