Resubmissions

11-12-2024 15:32

241211-sy44nssrdm 10

09-08-2024 21:57

240809-1t1vfs1cpm 10

06-08-2024 13:01

240806-p9f97szdlm 10

06-08-2024 12:52

240806-p3672stdkg 10

06-08-2024 12:29

240806-ppa8fsygqr 10

06-08-2024 12:26

240806-pmc92ashlh 10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-08-2024 12:29

General

  • Target

    1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe

  • Size

    109KB

  • MD5

    2da5e6b97759d3537cbd23e9fdb2b770

  • SHA1

    cabbf38051fa6657e28a12dee92042e44d8b72cb

  • SHA256

    4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5

  • SHA512

    7ea710ed16326bd0841f403c9db260a20dfec5f22fe2fd85970d51764e612c4a495a7c9abec6999dc8e1a7134656a4d65994c8f4cc138bb353b43a7be9b1698b

  • SSDEEP

    1536:jr7WmLwJll8imS4qZyNRMCuCDGSLf0Rc/cVjpnrRWKkystINby+xXm8lMwGHG6w:jmdyGSLfIFtnrRKysYyMWvpm6w

Malware Config

Extracted

Family

redline

Botnet

6951125327

C2

https://t.me/+7Lir0e4Gw381MDhi

https://steamcommunity.com/profiles/76561199038841443

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
    "C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4024-0-0x00007FFC99A63000-0x00007FFC99A65000-memory.dmp

    Filesize

    8KB

  • memory/4024-1-0x000001690F120000-0x000001690F142000-memory.dmp

    Filesize

    136KB

  • memory/4024-2-0x0000016929830000-0x000001692993A000-memory.dmp

    Filesize

    1.0MB

  • memory/4024-3-0x0000016910E20000-0x0000016910E32000-memory.dmp

    Filesize

    72KB

  • memory/4024-4-0x00007FFC99A60000-0x00007FFC9A521000-memory.dmp

    Filesize

    10.8MB

  • memory/4024-5-0x0000016929580000-0x00000169295BC000-memory.dmp

    Filesize

    240KB

  • memory/4024-6-0x00007FFC99A63000-0x00007FFC99A65000-memory.dmp

    Filesize

    8KB

  • memory/4024-7-0x00007FFC99A60000-0x00007FFC9A521000-memory.dmp

    Filesize

    10.8MB