Analysis
- max time kernel
140s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/11/2024, 14:30
General
- Target 1de49687cfdcc0ad20c310aec8122fa25c86a39ccf6bd91ea53d2a371796de6a.exe
- Size 440KB
- Sample241109-rt9ypavpdx
- SHA256 1de49687cfdcc0ad20c310aec8122fa25c86a39ccf6bd91ea53d2a371796de6a
Malware Config
Extracted
-
redline
-
rodik
-
193.233.20.23:4124
-
auth_value
59b6e22e7cfd9b5fa0c99d1942f7c85d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de49687cfdcc0ad20c310aec8122fa25c86a39ccf6bd91ea53d2a371796de6a.exe"C:\Users\Admin\AppData\Local\Temp\1de49687cfdcc0ad20c310aec8122fa25c86a39ccf6bd91ea53d2a371796de6a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lPq28Gb15.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lPq28Gb15.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
lPq28Gb15.exe
memory/980-8-0x0000000002C80000-0x0000000002D80000-memory.dmp
memory/980-10-0x0000000000400000-0x000000000044E000-memory.dmp
memory/980-9-0x0000000002E20000-0x0000000002E6B000-memory.dmp
memory/980-11-0x00000000049C0000-0x0000000004A06000-memory.dmp
memory/980-12-0x00000000073B0000-0x0000000007954000-memory.dmp
memory/980-14-0x0000000000400000-0x0000000002BB0000-memory.dmp
memory/980-13-0x00000000071C0000-0x0000000007204000-memory.dmp
memory/980-60-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-70-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-78-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-76-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-74-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-72-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-68-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-66-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-64-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-62-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-58-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-57-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-54-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-52-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-50-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-46-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-44-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-42-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-40-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-38-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-36-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-34-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-30-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-28-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-26-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-24-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-22-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-20-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-18-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-16-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-15-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-48-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-32-0x00000000071C0000-0x00000000071FF000-memory.dmp
memory/980-921-0x0000000007960000-0x0000000007F78000-memory.dmp
memory/980-922-0x0000000007F80000-0x000000000808A000-memory.dmp
memory/980-923-0x00000000072D0000-0x00000000072E2000-memory.dmp
memory/980-924-0x00000000072F0000-0x000000000732C000-memory.dmp
memory/980-925-0x0000000007340000-0x000000000738C000-memory.dmp
memory/980-926-0x0000000002C80000-0x0000000002D80000-memory.dmp
memory/980-927-0x0000000002E20000-0x0000000002E6B000-memory.dmp
memory/980-928-0x0000000000400000-0x000000000044E000-memory.dmp