Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 04:39
General
- Target 440e1e5f6aa5a0932ef646a3f7be7c693b2ec15bb3c3c4fa9af9a257fa6c65d8.exe
- Size 435KB
- Sample241107-e9416avlft
- SHA256 440e1e5f6aa5a0932ef646a3f7be7c693b2ec15bb3c3c4fa9af9a257fa6c65d8
Malware Config
Extracted
-
redline
-
rodik
-
193.233.20.23:4124
-
auth_value
59b6e22e7cfd9b5fa0c99d1942f7c85d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\440e1e5f6aa5a0932ef646a3f7be7c693b2ec15bb3c3c4fa9af9a257fa6c65d8.exe"C:\Users\Admin\AppData\Local\Temp\440e1e5f6aa5a0932ef646a3f7be7c693b2ec15bb3c3c4fa9af9a257fa6c65d8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lql87Vp48.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lql87Vp48.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
lql87Vp48.exe
memory/3592-8-0x0000000002D60000-0x0000000002E60000-memory.dmp
memory/3592-9-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3592-10-0x0000000007250000-0x0000000007296000-memory.dmp
memory/3592-11-0x0000000007370000-0x0000000007914000-memory.dmp
memory/3592-12-0x00000000072D0000-0x0000000007314000-memory.dmp
memory/3592-13-0x0000000000400000-0x0000000002BA8000-memory.dmp
memory/3592-41-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-43-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-77-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-75-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-303-0x0000000000400000-0x0000000002BA8000-memory.dmp
memory/3592-71-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-69-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-67-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-65-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-63-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-61-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-57-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-55-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-53-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-51-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-49-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-47-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-45-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-39-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-37-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-35-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-33-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-31-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-29-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-27-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-25-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-23-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-21-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-17-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-15-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-14-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-73-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-59-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-19-0x00000000072D0000-0x000000000730F000-memory.dmp
memory/3592-921-0x0000000007920000-0x0000000007F38000-memory.dmp
memory/3592-922-0x0000000007FB0000-0x00000000080BA000-memory.dmp
memory/3592-923-0x00000000080F0000-0x0000000008102000-memory.dmp
memory/3592-924-0x0000000008110000-0x000000000814C000-memory.dmp
memory/3592-925-0x0000000008260000-0x00000000082AC000-memory.dmp
memory/3592-927-0x0000000002D60000-0x0000000002E60000-memory.dmp
memory/3592-928-0x0000000000400000-0x000000000044E000-memory.dmp