Resubmissions
11/12/2024, 15:32
241211-sy44nssrdm1009/08/2024, 21:57
240809-1t1vfs1cpm1006/08/2024, 13:03
240806-qas1dszdqm06/08/2024, 13:01
240806-p9f97szdlm1006/08/2024, 12:52
240806-p3672stdkg1006/08/2024, 12:29
240806-ppa8fsygqr1006/08/2024, 12:29
240806-pn9pmaygqq06/08/2024, 12:26
240806-pmc92ashlh10Analysis
- max time kernel
58s - max time network
66s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
- submitted
06/08/2024, 13:01
General
- Target 1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
- Size 109KB
- Sample240806-p9f97szdlm
- SHA256 4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
6951125327
C2
-
https://t.me/+7Lir0e4Gw381MDhi
-
https://steamcommunity.com/profiles/76561199038841443
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
CabD56A.tmp
TarD5AC.tmp
memory/1976-0-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp
memory/1976-1-0x00000000010F0000-0x0000000001112000-memory.dmp
memory/1976-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp
memory/1976-37-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp
memory/1976-38-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp