Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 09:18

General

  • Target

    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe

  • Size

    297KB

  • MD5

    b486481f66040b69522cbec42185bee3

  • SHA1

    bcf25bc9895a676e896b4008a714fc083c882ca4

  • SHA256

    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9

  • SHA512

    60c6b76f2f930208e35a58a34d33593cba3f12c30ccba53d783f342a1d31f65d359a5f976827858edc0b05d5fe657c1e1f7a9f4eeeb713f3c4235478427f03ea

  • SSDEEP

    6144:bvzGiXPoPRvZzhR9WEjQJIud9k70st5J0c8f0wPIQJ:bLGiXPoPRxYEjQJIudS0SJ0c8f0wP

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    "C:\Users\Admin\AppData\Local\Temp\72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3456

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    249.108.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    249.108.222.173.in-addr.arpa
    IN PTR
    Response
    249.108.222.173.in-addr.arpa
    IN PTR
    a173-222-108-249deploystaticakamaitechnologiescom
  • flag-us
    DNS
    69.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    101.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    101.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    226.108.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.108.222.173.in-addr.arpa
    IN PTR
    Response
    226.108.222.173.in-addr.arpa
    IN PTR
    a173-222-108-226deploystaticakamaitechnologiescom
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 45.9.20.59:46287
    72f77d922540748952c435e6ab5213607df12b07005cce9a5efbd5b2d361f4a9.exe
    260 B
    5
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    249.108.222.173.in-addr.arpa
    dns
    74 B
    141 B
    1
    1

    DNS Request

    249.108.222.173.in-addr.arpa

  • 8.8.8.8:53
    69.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    69.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    101.209.201.84.in-addr.arpa
    dns
    73 B
    133 B
    1
    1

    DNS Request

    101.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    226.108.222.173.in-addr.arpa
    dns
    74 B
    141 B
    1
    1

    DNS Request

    226.108.222.173.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3456-0-0x00000000048D0000-0x00000000048FB000-memory.dmp

    Filesize

    172KB

  • memory/3456-1-0x0000000004900000-0x0000000004939000-memory.dmp

    Filesize

    228KB

  • memory/3456-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3456-3-0x0000000004A20000-0x0000000004A54000-memory.dmp

    Filesize

    208KB

  • memory/3456-4-0x0000000007590000-0x0000000007B34000-memory.dmp

    Filesize

    5.6MB

  • memory/3456-5-0x0000000004D40000-0x0000000004D72000-memory.dmp

    Filesize

    200KB

  • memory/3456-6-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/3456-64-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-44-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-32-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-70-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-68-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-67-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-62-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-60-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-58-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-56-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-54-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-52-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-50-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-48-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-46-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-42-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-40-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-38-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-36-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-34-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-30-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-28-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-26-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-24-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-22-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-20-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-18-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-16-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-14-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-12-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-10-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-8-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-7-0x0000000004D40000-0x0000000004D6C000-memory.dmp

    Filesize

    176KB

  • memory/3456-957-0x0000000007B40000-0x0000000008158000-memory.dmp

    Filesize

    6.1MB

  • memory/3456-958-0x00000000073C0000-0x00000000073D2000-memory.dmp

    Filesize

    72KB

  • memory/3456-959-0x00000000073E0000-0x00000000074EA000-memory.dmp

    Filesize

    1.0MB

  • memory/3456-960-0x0000000007500000-0x000000000753C000-memory.dmp

    Filesize

    240KB

  • memory/3456-961-0x0000000008160000-0x00000000081AC000-memory.dmp

    Filesize

    304KB

  • memory/3456-962-0x00000000048D0000-0x00000000048FB000-memory.dmp

    Filesize

    172KB

  • memory/3456-963-0x0000000004900000-0x0000000004939000-memory.dmp

    Filesize

    228KB

  • memory/3456-964-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.