Analysis

  • max time kernel
    141s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-11-2024 22:59

General

  • Target

    6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe

  • Size

    297KB

  • MD5

    5269de82606586359ab85bba6cf33d99

  • SHA1

    8574c6fe2429b7c72f0f77dd69e7f960dbd8a310

  • SHA256

    6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85

  • SHA512

    d48f0b06ab70b115bfd4184a91741e418f37143f1a2546b76f9c6eacd017efc8f5e00ae7a1186ab1f3ba296af91c67c473cf06acb38fdf2c8340b2368c761cd6

  • SSDEEP

    6144:bHX+iXvoPGKN3MYAXcK6YWo2mYLVe2PRy6u802JJs:b3+iXvoPoYISTLVHZy6zJ

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe
    "C:\Users\Admin\AppData\Local\Temp\6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/380-0-0x0000000004790000-0x00000000047BB000-memory.dmp

    Filesize

    172KB

  • memory/380-1-0x00000000047C0000-0x00000000047F9000-memory.dmp

    Filesize

    228KB

  • memory/380-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/380-3-0x0000000004950000-0x0000000004984000-memory.dmp

    Filesize

    208KB

  • memory/380-4-0x0000000007340000-0x00000000078E4000-memory.dmp

    Filesize

    5.6MB

  • memory/380-5-0x0000000004D40000-0x0000000004D72000-memory.dmp

    Filesize

    200KB

  • memory/380-6-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/380-14-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-70-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-68-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-66-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-64-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-60-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-58-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-56-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-54-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-52-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-50-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-48-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-44-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-42-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-40-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-38-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-36-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-34-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-32-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-28-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-26-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-24-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-22-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-21-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-18-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-16-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-12-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-10-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-8-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-7-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-62-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-46-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-30-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/380-958-0x0000000007270000-0x0000000007282000-memory.dmp

    Filesize

    72KB

  • memory/380-957-0x00000000078F0000-0x0000000007F08000-memory.dmp

    Filesize

    6.1MB

  • memory/380-959-0x0000000007F10000-0x000000000801A000-memory.dmp

    Filesize

    1.0MB

  • memory/380-960-0x00000000072B0000-0x00000000072EC000-memory.dmp

    Filesize

    240KB

  • memory/380-961-0x0000000008020000-0x000000000806C000-memory.dmp

    Filesize

    304KB

  • memory/380-962-0x0000000004790000-0x00000000047BB000-memory.dmp

    Filesize

    172KB

  • memory/380-964-0x00000000047C0000-0x00000000047F9000-memory.dmp

    Filesize

    228KB

  • memory/380-965-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB