Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/11/2024, 14:04
General
- Target 18a3e9de5a17119fbfb0de79ea53dad9e3119e12cc0f3981d609432939e6c56a.exe
- Size 441KB
- Sample241106-rdpykstncm
- SHA256 18a3e9de5a17119fbfb0de79ea53dad9e3119e12cc0f3981d609432939e6c56a
Malware Config
Extracted
-
redline
-
rodik
-
193.233.20.23:4124
-
auth_value
59b6e22e7cfd9b5fa0c99d1942f7c85d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18a3e9de5a17119fbfb0de79ea53dad9e3119e12cc0f3981d609432939e6c56a.exe"C:\Users\Admin\AppData\Local\Temp\18a3e9de5a17119fbfb0de79ea53dad9e3119e12cc0f3981d609432939e6c56a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lVC40Ob25.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lVC40Ob25.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
lVC40Ob25.exe
memory/4252-8-0x0000000002E50000-0x0000000002F50000-memory.dmp
memory/4252-9-0x0000000002D80000-0x0000000002DCB000-memory.dmp
memory/4252-10-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4252-11-0x0000000007120000-0x0000000007166000-memory.dmp
memory/4252-13-0x00000000071A0000-0x00000000071E4000-memory.dmp
memory/4252-12-0x0000000007310000-0x00000000078B4000-memory.dmp
memory/4252-14-0x0000000000400000-0x0000000002BC5000-memory.dmp
memory/4252-72-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-60-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-52-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-34-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-78-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-76-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-74-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-70-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-68-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-66-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-64-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-62-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-58-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-56-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-54-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-50-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-48-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-47-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-44-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-42-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-40-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-38-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-36-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-32-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-30-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-28-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-26-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-24-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-22-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-20-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-18-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-16-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-15-0x00000000071A0000-0x00000000071DF000-memory.dmp
memory/4252-921-0x00000000078C0000-0x0000000007ED8000-memory.dmp
memory/4252-922-0x0000000007EE0000-0x0000000007FEA000-memory.dmp
memory/4252-923-0x0000000007FF0000-0x0000000008002000-memory.dmp
memory/4252-924-0x0000000008010000-0x000000000804C000-memory.dmp
memory/4252-925-0x0000000008150000-0x000000000819C000-memory.dmp
memory/4252-926-0x0000000002E50000-0x0000000002F50000-memory.dmp
memory/4252-927-0x0000000002D80000-0x0000000002DCB000-memory.dmp
memory/4252-929-0x0000000000400000-0x000000000044E000-memory.dmp