Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 07:59

General

  • Target

    4241fa2948654d5befa3f32e1adfcec7333a46d4d2307428823925812781587e.exe

  • Size

    297KB

  • MD5

    86984ef1647cac1f8d3a6438415f1fdf

  • SHA1

    a51f77e916222beee249ffa4add5ad2d3881749c

  • SHA256

    4241fa2948654d5befa3f32e1adfcec7333a46d4d2307428823925812781587e

  • SHA512

    647fe08e2ad66deabd2e76738dee2b9ae80989224e801279279c7cf69d0875ba183272b7623926fe8c9c7dbf6afc869dd66907b663c56515960414e8f757927b

  • SSDEEP

    6144:rvHwCMbovQJ2lzmGk2l3u7ZOuc50Cb/7rRSUbHMfG4:rPwCMbovQJ6N3u7ZeR/7Ce

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4241fa2948654d5befa3f32e1adfcec7333a46d4d2307428823925812781587e.exe
    "C:\Users\Admin\AppData\Local\Temp\4241fa2948654d5befa3f32e1adfcec7333a46d4d2307428823925812781587e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:5076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5076-0-0x0000000002D30000-0x0000000002D5B000-memory.dmp

    Filesize

    172KB

  • memory/5076-1-0x0000000004920000-0x0000000004959000-memory.dmp

    Filesize

    228KB

  • memory/5076-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/5076-3-0x0000000004C70000-0x0000000004CA4000-memory.dmp

    Filesize

    208KB

  • memory/5076-4-0x00000000075B0000-0x0000000007B54000-memory.dmp

    Filesize

    5.6MB

  • memory/5076-5-0x0000000004D50000-0x0000000004D82000-memory.dmp

    Filesize

    200KB

  • memory/5076-6-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/5076-36-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-34-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-32-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-30-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-28-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-26-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-24-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-22-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-20-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-18-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-16-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-14-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-12-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-10-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-8-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-7-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-70-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-68-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-66-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-64-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-62-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-60-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-58-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-56-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-54-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-52-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-50-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-48-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-46-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-44-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-42-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-40-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-38-0x0000000004D50000-0x0000000004D7C000-memory.dmp

    Filesize

    176KB

  • memory/5076-957-0x0000000007B60000-0x0000000008178000-memory.dmp

    Filesize

    6.1MB

  • memory/5076-958-0x0000000004E60000-0x0000000004E72000-memory.dmp

    Filesize

    72KB

  • memory/5076-959-0x0000000007440000-0x000000000754A000-memory.dmp

    Filesize

    1.0MB

  • memory/5076-960-0x0000000004EA0000-0x0000000004EDC000-memory.dmp

    Filesize

    240KB

  • memory/5076-961-0x0000000008180000-0x00000000081CC000-memory.dmp

    Filesize

    304KB

  • memory/5076-962-0x0000000002D30000-0x0000000002D5B000-memory.dmp

    Filesize

    172KB

  • memory/5076-963-0x0000000004920000-0x0000000004959000-memory.dmp

    Filesize

    228KB

  • memory/5076-964-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB