Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 11:46
General
- Target b76b1fc2db24e560b588016cacb56660fe63ff43d8a1dddde0acf711aa68f0dc.exe
- Size 433KB
- Sample241107-nxeeeasakq
- SHA256 b76b1fc2db24e560b588016cacb56660fe63ff43d8a1dddde0acf711aa68f0dc
Malware Config
Extracted
-
redline
-
rodik
-
193.233.20.23:4124
-
auth_value
59b6e22e7cfd9b5fa0c99d1942f7c85d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b76b1fc2db24e560b588016cacb56660fe63ff43d8a1dddde0acf711aa68f0dc.exe"C:\Users\Admin\AppData\Local\Temp\b76b1fc2db24e560b588016cacb56660fe63ff43d8a1dddde0acf711aa68f0dc.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\euU83da55.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\euU83da55.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
euU83da55.exe
memory/3060-8-0x0000000002CC0000-0x0000000002DC0000-memory.dmp
memory/3060-9-0x00000000046F0000-0x000000000473B000-memory.dmp
memory/3060-10-0x0000000000400000-0x000000000044E000-memory.dmp
memory/3060-11-0x0000000007130000-0x0000000007176000-memory.dmp
memory/3060-12-0x0000000007220000-0x00000000077C4000-memory.dmp
memory/3060-13-0x00000000071B0000-0x00000000071F4000-memory.dmp
memory/3060-14-0x0000000000400000-0x0000000002BB1000-memory.dmp
memory/3060-52-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-66-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-78-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-76-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-74-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-72-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-70-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-68-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-64-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-62-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-60-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-58-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-56-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-54-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-44-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-42-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-40-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-38-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-34-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-32-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-30-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-28-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-26-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-25-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-22-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-20-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-50-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-48-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-46-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-36-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-18-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-16-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-15-0x00000000071B0000-0x00000000071EF000-memory.dmp
memory/3060-921-0x00000000077F0000-0x0000000007E08000-memory.dmp
memory/3060-922-0x0000000007E90000-0x0000000007F9A000-memory.dmp
memory/3060-923-0x0000000007FD0000-0x0000000007FE2000-memory.dmp
memory/3060-924-0x0000000007FF0000-0x000000000802C000-memory.dmp
memory/3060-925-0x0000000008140000-0x000000000818C000-memory.dmp
memory/3060-926-0x0000000002CC0000-0x0000000002DC0000-memory.dmp
memory/3060-927-0x00000000046F0000-0x000000000473B000-memory.dmp
memory/3060-928-0x0000000000400000-0x000000000044E000-memory.dmp