Analysis

  • max time kernel
    140s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 00:02

General

  • Target

    4f3baa3483adb1d446762530e2f63e423c444a4f75b59a6b11504b72ce6cf98c.exe

  • Size

    422KB

  • MD5

    ac26c2b3e563674f56bc1a862e615fbc

  • SHA1

    c8f38bb662232c6fc96ca80278fe6e19bd6a704d

  • SHA256

    4f3baa3483adb1d446762530e2f63e423c444a4f75b59a6b11504b72ce6cf98c

  • SHA512

    2f4c6f562abe8e720d999265b77105c4d9b789236d305f8cb30e0df69806cbead0996a36154a72cea4d6952f5453cb5a994510ed049074c036ce63ef53707136

  • SSDEEP

    12288:snEt5YG/nn8LXObRBxF6fSoDJMeAZomw:snw/nCXObf6zNMGN

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f3baa3483adb1d446762530e2f63e423c444a4f75b59a6b11504b72ce6cf98c.exe
    "C:\Users\Admin\AppData\Local\Temp\4f3baa3483adb1d446762530e2f63e423c444a4f75b59a6b11504b72ce6cf98c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1420-1-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

  • memory/1420-2-0x00000000005C0000-0x00000000005F9000-memory.dmp

    Filesize

    228KB

  • memory/1420-3-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1420-4-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/1420-5-0x0000000002520000-0x0000000002554000-memory.dmp

    Filesize

    208KB

  • memory/1420-6-0x0000000004CF0000-0x0000000005294000-memory.dmp

    Filesize

    5.6MB

  • memory/1420-7-0x0000000004BE0000-0x0000000004C12000-memory.dmp

    Filesize

    200KB

  • memory/1420-71-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-63-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-47-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-33-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-15-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-9-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-8-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-69-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-67-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-66-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-61-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-59-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-57-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-55-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-53-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-51-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-49-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-45-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-43-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-41-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-39-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-37-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-35-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-31-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-29-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-27-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-25-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-23-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-21-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-19-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-17-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-13-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-11-0x0000000004BE0000-0x0000000004C0C000-memory.dmp

    Filesize

    176KB

  • memory/1420-958-0x00000000052A0000-0x00000000058B8000-memory.dmp

    Filesize

    6.1MB

  • memory/1420-959-0x00000000058C0000-0x00000000058D2000-memory.dmp

    Filesize

    72KB

  • memory/1420-960-0x00000000058E0000-0x00000000059EA000-memory.dmp

    Filesize

    1.0MB

  • memory/1420-961-0x0000000005A10000-0x0000000005A4C000-memory.dmp

    Filesize

    240KB

  • memory/1420-962-0x0000000005A80000-0x0000000005ACC000-memory.dmp

    Filesize

    304KB

  • memory/1420-963-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

  • memory/1420-964-0x00000000005C0000-0x00000000005F9000-memory.dmp

    Filesize

    228KB

  • memory/1420-965-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB