Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 02:17

General

  • Target

    f7b6deace6b231c884b72e90d659fea39604e78816f390c8013a1d224b7bc655.exe

  • Size

    351KB

  • MD5

    c03ee94df38b19e84a853d3beb01eac0

  • SHA1

    08a78d422d16115c6ddd605862aeaf9d86e1b1b3

  • SHA256

    f7b6deace6b231c884b72e90d659fea39604e78816f390c8013a1d224b7bc655

  • SHA512

    9fdcb4e3c5dc69494f32c498188001884ab6562b6006fcb295e81ceb462795dddda172071bdc3c107f9faec331e5f80837ea41dfb841b0ed64724ffaad61f68d

  • SSDEEP

    6144:vW9tAX5oidOVmKqb2+ma+N1AMpLW9BQSy:vW6oidig2+maQAw6B4

Malware Config

Extracted

Family

redline

Botnet

SewPalpadin

C2

193.233.48.58:38989

Attributes
  • auth_value

    7a741aa449c2131b60755b6dc189af74

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7b6deace6b231c884b72e90d659fea39604e78816f390c8013a1d224b7bc655.exe
    "C:\Users\Admin\AppData\Local\Temp\f7b6deace6b231c884b72e90d659fea39604e78816f390c8013a1d224b7bc655.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2884-1-0x00000000004C0000-0x00000000005C0000-memory.dmp

    Filesize

    1024KB

  • memory/2884-2-0x00000000020D0000-0x000000000210A000-memory.dmp

    Filesize

    232KB

  • memory/2884-3-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2884-4-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2884-5-0x0000000002410000-0x0000000002446000-memory.dmp

    Filesize

    216KB

  • memory/2884-6-0x0000000004D00000-0x00000000052A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2884-7-0x0000000002510000-0x0000000002544000-memory.dmp

    Filesize

    208KB

  • memory/2884-19-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-71-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-70-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-67-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-65-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-64-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-62-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-59-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-57-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-56-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-51-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-49-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-47-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-45-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-43-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-41-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-37-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-35-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-33-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-25-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-23-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-21-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-17-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-15-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-13-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-53-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-11-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-39-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-9-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-31-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-29-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-27-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-8-0x0000000002510000-0x000000000253E000-memory.dmp

    Filesize

    184KB

  • memory/2884-962-0x00000000052B0000-0x00000000058C8000-memory.dmp

    Filesize

    6.1MB

  • memory/2884-963-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

    Filesize

    72KB

  • memory/2884-964-0x00000000058D0000-0x00000000059DA000-memory.dmp

    Filesize

    1.0MB

  • memory/2884-965-0x0000000004C10000-0x0000000004C4C000-memory.dmp

    Filesize

    240KB

  • memory/2884-966-0x0000000004C70000-0x0000000004CBC000-memory.dmp

    Filesize

    304KB

  • memory/2884-967-0x00000000004C0000-0x00000000005C0000-memory.dmp

    Filesize

    1024KB

  • memory/2884-968-0x00000000020D0000-0x000000000210A000-memory.dmp

    Filesize

    232KB

  • memory/2884-969-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB