Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
08/06/2024, 08:19
General
- Target f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe
- Size 2.5MB
- Sample240608-j7vf6abd24
- SHA256 f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
5.42.65.63:14707
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe"C:\Users\Admin\AppData\Local\Temp\f68e7282ed7df9a76ec492e06330c4ba4a1faf5a357795b41ab2c0743955d364.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1672-72-0x00000000058B0000-0x00000000058BA000-memory.dmp
memory/1672-79-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1672-78-0x0000000005A40000-0x0000000005A8C000-memory.dmp
memory/1672-76-0x0000000005990000-0x00000000059A2000-memory.dmp
memory/1672-77-0x00000000059F0000-0x0000000005A2C000-memory.dmp
memory/1672-75-0x0000000005AD0000-0x0000000005BDA000-memory.dmp
memory/1672-74-0x00000000067B0000-0x0000000006DC8000-memory.dmp
memory/1672-73-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1672-69-0x0000000005BE0000-0x0000000006184000-memory.dmp
memory/1672-71-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/1672-67-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3892-48-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-2-0x00000000057C0000-0x000000000585C000-memory.dmp
memory/3892-66-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-64-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-62-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-60-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-58-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-56-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-55-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-52-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-6-0x00000000056D0000-0x00000000056EC000-memory.dmp
memory/3892-51-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-0-0x000000007539E000-0x000000007539F000-memory.dmp
memory/3892-46-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-5-0x0000000005960000-0x0000000005A46000-memory.dmp
memory/3892-44-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-42-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-4-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/3892-3-0x0000000005860000-0x0000000005960000-memory.dmp
memory/3892-70-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/3892-40-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-38-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-36-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-34-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-32-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-30-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-28-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-26-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-24-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-22-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-20-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-18-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-16-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-14-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-12-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-10-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-8-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-7-0x00000000056D0000-0x00000000056E5000-memory.dmp
memory/3892-1-0x0000000000A80000-0x0000000000D10000-memory.dmp