Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 15:08

General

  • Target

    668f204aea8370656c80b45b9d89c5ccd62f39b86040e27fbda0cf2e921d805f.exe

  • Size

    297KB

  • MD5

    71cc881c5c544f829c024432254907eb

  • SHA1

    50d262074c93d36dada6f8328bc2e3a5bbf37f2f

  • SHA256

    668f204aea8370656c80b45b9d89c5ccd62f39b86040e27fbda0cf2e921d805f

  • SHA512

    c6481aaf06f49be801a70fcbe56c2c7815a9a8148da57f7d94646d1caf0ed345d51d7d46d9b4ff766d01f3a4e53599d4f2003dc4b1df34ab76f02e30c0d7387b

  • SSDEEP

    6144:bHX+iXvoPGKN3MYAXcK6YWo2mYLVe2PRy6u802JJs:b3+iXvoPoYISTLVHZy6zJ

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\668f204aea8370656c80b45b9d89c5ccd62f39b86040e27fbda0cf2e921d805f.exe
    "C:\Users\Admin\AppData\Local\Temp\668f204aea8370656c80b45b9d89c5ccd62f39b86040e27fbda0cf2e921d805f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4624-0-0x00000000047B0000-0x00000000047DB000-memory.dmp

    Filesize

    172KB

  • memory/4624-1-0x00000000047E0000-0x0000000004819000-memory.dmp

    Filesize

    228KB

  • memory/4624-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4624-3-0x0000000004920000-0x0000000004954000-memory.dmp

    Filesize

    208KB

  • memory/4624-4-0x0000000007290000-0x0000000007834000-memory.dmp

    Filesize

    5.6MB

  • memory/4624-5-0x0000000007180000-0x00000000071B2000-memory.dmp

    Filesize

    200KB

  • memory/4624-9-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-69-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-67-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-65-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-63-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-61-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-957-0x0000000007840000-0x0000000007E58000-memory.dmp

    Filesize

    6.1MB

  • memory/4624-958-0x0000000007E60000-0x0000000007E72000-memory.dmp

    Filesize

    72KB

  • memory/4624-959-0x0000000007E80000-0x0000000007F8A000-memory.dmp

    Filesize

    1.0MB

  • memory/4624-57-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-55-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-53-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-51-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-49-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-47-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-45-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-43-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-41-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-37-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-35-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-34-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-29-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-27-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-25-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-23-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-21-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-19-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-17-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-15-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-13-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-11-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-7-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-6-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-100-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/4624-59-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-39-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-31-0x0000000007180000-0x00000000071AC000-memory.dmp

    Filesize

    176KB

  • memory/4624-960-0x0000000007FA0000-0x0000000007FDC000-memory.dmp

    Filesize

    240KB

  • memory/4624-961-0x0000000008010000-0x000000000805C000-memory.dmp

    Filesize

    304KB

  • memory/4624-962-0x00000000047B0000-0x00000000047DB000-memory.dmp

    Filesize

    172KB

  • memory/4624-963-0x00000000047E0000-0x0000000004819000-memory.dmp

    Filesize

    228KB

  • memory/4624-965-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB