Analysis
- max time kernel
150s - max time network
147s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
- submitted
09/11/2024, 10:54
General
- Target 7cf63b13f31b2fabd3c21dd219b4ee1fa832939e.exe
- Size 324KB
- Sample241109-mz2gaawkfq
- SHA256 7afff05c16f7d91deed023b31ab264a5a59a5b4f38be33d23a44069b926032ab
Malware Config
Extracted
-
redline
-
TripleSBanks
-
185.143.223.90:10024
-
auth_value
064872fe393e6f3a6d60eca59269d528
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cf63b13f31b2fabd3c21dd219b4ee1fa832939e.exe"C:\Users\Admin\AppData\Local\Temp\7cf63b13f31b2fabd3c21dd219b4ee1fa832939e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2540-1-0x0000000000AD0000-0x0000000000BD0000-memory.dmp
memory/2540-2-0x0000000000220000-0x0000000000261000-memory.dmp
memory/2540-3-0x0000000000400000-0x0000000000444000-memory.dmp
memory/2540-4-0x0000000000400000-0x000000000091B000-memory.dmp
memory/2540-5-0x0000000004C00000-0x0000000004C3C000-memory.dmp
memory/2540-6-0x0000000004C40000-0x0000000004C7A000-memory.dmp
memory/2540-7-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-8-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-10-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-12-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-14-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-16-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-18-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-34-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-40-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-42-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-36-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-32-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-30-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-28-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-26-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-52-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-24-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-38-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-22-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-20-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-44-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-48-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-56-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-64-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-70-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-68-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-66-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-62-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-60-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-58-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-54-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-50-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-46-0x0000000004C40000-0x0000000004C74000-memory.dmp
memory/2540-961-0x0000000000AD0000-0x0000000000BD0000-memory.dmp
memory/2540-962-0x0000000000220000-0x0000000000261000-memory.dmp
memory/2540-963-0x0000000000400000-0x0000000000444000-memory.dmp