Malware Analysis Report

2025-04-03 11:31

Sample ID 241109-3atyxaxkfn
Target 994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2
SHA256 994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2
Tags
redline 1 discovery infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2

Threat Level: Known bad

The file 994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2 was found to be: Known bad.

Malicious Activity Summary

redline 1 discovery infostealer

RedLine

RedLine payload

Redline family

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 23:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 23:19

Reported

2024-11-09 23:21

Platform

win7-20240903-en

Max time kernel

140s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe

"C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe"

Network

Country Destination Domain Proto
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp

Files

memory/1320-1-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1320-2-0x00000000004F0000-0x0000000000529000-memory.dmp

memory/1320-3-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1320-4-0x0000000000400000-0x00000000004EF000-memory.dmp

memory/1320-5-0x0000000002120000-0x0000000002154000-memory.dmp

memory/1320-6-0x0000000004770000-0x00000000047A2000-memory.dmp

memory/1320-7-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-8-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-10-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-12-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-14-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-16-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-18-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-26-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-32-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-36-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-34-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-30-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-28-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-24-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-22-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-20-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-44-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-54-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-52-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-50-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-48-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-46-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-42-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-40-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-38-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-68-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-56-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-66-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-70-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-64-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-63-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-60-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-58-0x0000000004770000-0x000000000479C000-memory.dmp

memory/1320-957-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1320-958-0x00000000004F0000-0x0000000000529000-memory.dmp

memory/1320-959-0x0000000000400000-0x000000000043C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 23:19

Reported

2024-11-09 23:21

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe

"C:\Users\Admin\AppData\Local\Temp\994c6cec1abf4b174d01e0a71f528b123eb882e3739facb4c2893b681eff0bc2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
NL 45.9.20.59:46287 tcp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
NL 45.9.20.59:46287 tcp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
NL 45.9.20.59:46287 tcp
NL 45.9.20.59:46287 tcp

Files

memory/5024-1-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/5024-2-0x00000000001C0000-0x00000000001F9000-memory.dmp

memory/5024-3-0x0000000000400000-0x000000000043C000-memory.dmp

memory/5024-4-0x0000000000400000-0x00000000004EF000-memory.dmp

memory/5024-5-0x0000000002520000-0x0000000002554000-memory.dmp

memory/5024-6-0x0000000004DC0000-0x0000000005364000-memory.dmp

memory/5024-7-0x0000000002740000-0x0000000002772000-memory.dmp

memory/5024-41-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-71-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-69-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-67-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-65-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-958-0x0000000005370000-0x0000000005988000-memory.dmp

memory/5024-960-0x0000000005990000-0x0000000005A9A000-memory.dmp

memory/5024-959-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

memory/5024-63-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-61-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-59-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-57-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-55-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-53-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-51-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-49-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-47-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-45-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-43-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-39-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-37-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-35-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-33-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-31-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-29-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-27-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-25-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-23-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-21-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-19-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-17-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-15-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-13-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-11-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-9-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-8-0x0000000002740000-0x000000000276C000-memory.dmp

memory/5024-961-0x0000000004D20000-0x0000000004D5C000-memory.dmp

memory/5024-962-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

memory/5024-963-0x00000000006E0000-0x00000000007E0000-memory.dmp

memory/5024-964-0x00000000001C0000-0x00000000001F9000-memory.dmp

memory/5024-965-0x0000000000400000-0x000000000043C000-memory.dmp