Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07/11/2024, 07:10 UTC
General
-
Target
add26ef9d294839fb3ab25761e0118d588a61a1741f9bfad0f2fb9c64474cc36.exe
-
Size
427KB
-
MD5
cb2207aeeb2fef11b95c2ef6c8385324
-
SHA1
de204970177559f51b00015bc05d978255b49d32
-
SHA256
add26ef9d294839fb3ab25761e0118d588a61a1741f9bfad0f2fb9c64474cc36
-
SHA512
a2add94d6081707ba8f5dad03e7a4ae3d35209e7370390fe608c5112e26479a1b51ce501cbd96ecf8c3c5684d415ac8a23ba8ae9f60974099dd57f04108f787b
-
SSDEEP
12288:bI98VfhyNpDL3EwI6si3LbQMojbyZSnPsUx34:gx1EwNCyOP9S
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
1
C2
45.9.20.59:46287
Attributes
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\add26ef9d294839fb3ab25761e0118d588a61a1741f9bfad0f2fb9c64474cc36.exe"C:\Users\Admin\AppData\Local\Temp\add26ef9d294839fb3ab25761e0118d588a61a1741f9bfad0f2fb9c64474cc36.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse -
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTR
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
DNS28.118.140.52.in-addr.arpaRemote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTR
-
DNS56.163.245.4.in-addr.arpaRemote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
DNS56.163.245.4.in-addr.arpaRemote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTR
-
DNS56.163.245.4.in-addr.arpaRemote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTR
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS98.117.19.2.in-addr.arpaRemote address:8.8.8.8:53Request98.117.19.2.in-addr.arpaIN PTRResponse98.117.19.2.in-addr.arpaIN PTRa2-19-117-98deploystaticakamaitechnologiescom
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
45.9.20.59:46287 -
45.9.20.59:46287
-
45.9.20.59:46287
-
45.9.20.59:46287
-
45.9.20.59:46287
-
45.9.20.59:46287
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5371.31.126.40.in-addr.arpadns
DNS Request
71.31.126.40.in-addr.arpa
DNS Request
71.31.126.40.in-addr.arpa
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:5328.118.140.52.in-addr.arpadns
DNS Request
28.118.140.52.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5356.163.245.4.in-addr.arpadns
DNS Request
56.163.245.4.in-addr.arpa
DNS Request
56.163.245.4.in-addr.arpa
DNS Request
56.163.245.4.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5398.117.19.2.in-addr.arpadns
DNS Request
98.117.19.2.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
228KB
-
Filesize
240KB
-
Filesize
944KB
-
Filesize
208KB
-
Filesize
5.6MB
-
Filesize
200KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
228KB
-
Filesize
240KB