Resubmissions
11/12/2024, 15:32
241211-sy44nssrdm1009/08/2024, 21:57
240809-1t1vfs1cpm1006/08/2024, 13:03
240806-qas1dszdqm06/08/2024, 13:01
240806-p9f97szdlm1006/08/2024, 12:52
240806-p3672stdkg1006/08/2024, 12:29
240806-ppa8fsygqr1006/08/2024, 12:29
240806-pn9pmaygqq06/08/2024, 12:26
240806-pmc92ashlh10Analysis
- max time kernel
44s - max time network
61s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
06/08/2024, 12:52
General
- Target 1/e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe
- Size 338KB
- Sample240806-p3672stdkg
- SHA256 e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451
Malware Config
Extracted
-
redline
-
6951125327
-
https://t.me/+7Lir0e4Gw381MDhi
-
https://steamcommunity.com/profiles/76561199038841443
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe"C:\Users\Admin\AppData\Local\Temp\1\e886016e48bf0e3cd100d627678f345743509fd5f57f3c9b182f2833352bd451.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2024-0-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2024-2-0x000000007467E000-0x000000007467F000-memory.dmp
memory/2024-3-0x00000000057B0000-0x0000000005816000-memory.dmp
memory/2024-4-0x00000000062A0000-0x00000000068B8000-memory.dmp
memory/2024-5-0x0000000005D30000-0x0000000005D42000-memory.dmp
memory/2024-6-0x0000000005E60000-0x0000000005F6A000-memory.dmp
memory/2024-7-0x0000000074670000-0x0000000074E21000-memory.dmp
memory/2024-8-0x0000000006200000-0x000000000623C000-memory.dmp
memory/2024-9-0x0000000006240000-0x000000000628C000-memory.dmp
memory/2024-10-0x000000007467E000-0x000000007467F000-memory.dmp
memory/2024-11-0x0000000074670000-0x0000000074E21000-memory.dmp
memory/4524-1-0x00000000008C0000-0x00000000008C1000-memory.dmp