Analysis

  • max time kernel
    140s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08-11-2024 10:05

General

  • Target

    06e3d5126634f3964f2096c6ee9a432ee29701eae67900a946ce8e33cecda827.exe

  • Size

    422KB

  • MD5

    cc7536e76cb5e0c4b823fa2869748d12

  • SHA1

    68e47c2c60dfa3f8312a8888d3add97f7f926b47

  • SHA256

    06e3d5126634f3964f2096c6ee9a432ee29701eae67900a946ce8e33cecda827

  • SHA512

    5b459c8928c2de616d17e1b2b990eff5e192ab3616bada40154c880dcc8702ebc3573db8cbc89fcc7736f05eed570b28f28461d2d440282e3342c947f32be14f

  • SSDEEP

    12288:snEt5YG/nn8LXObRBxF6fSoDJMeAZomw:snw/nCXObf6zNMGN

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06e3d5126634f3964f2096c6ee9a432ee29701eae67900a946ce8e33cecda827.exe
    "C:\Users\Admin\AppData\Local\Temp\06e3d5126634f3964f2096c6ee9a432ee29701eae67900a946ce8e33cecda827.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3052-1-0x0000000000600000-0x0000000000700000-memory.dmp

    Filesize

    1024KB

  • memory/3052-3-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3052-2-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/3052-4-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/3052-5-0x00000000005D0000-0x0000000000604000-memory.dmp

    Filesize

    208KB

  • memory/3052-6-0x0000000000740000-0x0000000000772000-memory.dmp

    Filesize

    200KB

  • memory/3052-7-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-8-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-10-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-12-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-14-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-16-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-18-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-24-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-22-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-26-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-20-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-28-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-30-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-32-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-34-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-36-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-38-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-40-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-42-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-44-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-46-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-48-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-50-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-52-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-54-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-60-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-70-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-68-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-66-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-64-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-62-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-58-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-56-0x0000000000740000-0x000000000076C000-memory.dmp

    Filesize

    176KB

  • memory/3052-957-0x0000000000600000-0x0000000000700000-memory.dmp

    Filesize

    1024KB

  • memory/3052-958-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/3052-959-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB