Resubmissions
11/12/2024, 15:32
241211-sy44nssrdm1009/08/2024, 21:57
240809-1t1vfs1cpm1006/08/2024, 13:03
240806-qas1dszdqm06/08/2024, 13:01
240806-p9f97szdlm1006/08/2024, 12:52
240806-p3672stdkg1006/08/2024, 12:29
240806-ppa8fsygqr1006/08/2024, 12:29
240806-pn9pmaygqq06/08/2024, 12:26
240806-pmc92ashlh10Analysis
- max time kernel
43s - max time network
60s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
06/08/2024, 12:52
General
- Target 1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
- Size 109KB
- Sample240806-p3672stdkg
- SHA256 4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5
Malware Config
Extracted
-
redline
-
6951125327
-
https://t.me/+7Lir0e4Gw381MDhi
-
https://steamcommunity.com/profiles/76561199038841443
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2068-0-0x00007FFE27013000-0x00007FFE27015000-memory.dmp
memory/2068-1-0x000002254B6D0000-0x000002254B6F2000-memory.dmp
memory/2068-2-0x0000022565E90000-0x0000022565F9A000-memory.dmp
memory/2068-3-0x000002254BB80000-0x000002254BB92000-memory.dmp
memory/2068-4-0x00007FFE27010000-0x00007FFE27AD2000-memory.dmp
memory/2068-5-0x000002254BC10000-0x000002254BC4C000-memory.dmp
memory/2068-6-0x00007FFE27010000-0x00007FFE27AD2000-memory.dmp