redline | cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc.exe
Size 272KB
Sample241109-3m2jhsvcpd
SHA256 cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc
MD5 aa3a5854ff46cf92cb538ae54cbf7752
SHA1 14d5715cc81e8c46d8d0abce156e31045a584dc1
SHA512 e51e996872c09495fdd3d99cee0db3cdb52c39c8393d4f992bdf354fe522fd4fd550e9f588be7748524e1682cf72633f1826468525d8081be13c50748da43a2f
SSDEEP 3072:H66joELH6Vt7CmJXBGprAFvLS9Ko40NLHUxhzOnIPrHapwxNn2pU9f2MKTV/wi4E:H66jwpRGpMFvLSexhanIPr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline stek discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

stek

melevv.eu:4162

Attributes

auth_value
4205381daf6946b2df5fe3bc7eacc918

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3180-1-0x0000000000560000-0x00000000005A4000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc.exe

C:\Users\Admin\AppData\Local\Temp\cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc.exe
"C:\Users\Admin\AppData\Local\Temp\cea8154b86aa37b39dd4c05c2b344115af5d1e8ad8bf0644eed01e68c28245fc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3180-0-0x000000007536E000-0x000000007536F000-memory.dmp

Download

memory/3180-1-0x0000000000560000-0x00000000005A4000-memory.dmp