Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/11/2024, 18:11
General
- Target 3655d2e065cb65365f3703850708462ae22f05d12f558a15edb5fc54efecbc73.exe
- Size 297KB
- Sample241109-wskpmazblm
- SHA256 3655d2e065cb65365f3703850708462ae22f05d12f558a15edb5fc54efecbc73
Malware Config
Extracted
-
redline
-
1
-
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3655d2e065cb65365f3703850708462ae22f05d12f558a15edb5fc54efecbc73.exe"C:\Users\Admin\AppData\Local\Temp\3655d2e065cb65365f3703850708462ae22f05d12f558a15edb5fc54efecbc73.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4220-0-0x00000000048D0000-0x00000000048FB000-memory.dmp
memory/4220-1-0x0000000004900000-0x0000000004939000-memory.dmp
memory/4220-2-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4220-3-0x00000000071F0000-0x0000000007224000-memory.dmp
memory/4220-4-0x00000000073B0000-0x0000000007954000-memory.dmp
memory/4220-5-0x00000000072B0000-0x00000000072E2000-memory.dmp
memory/4220-6-0x0000000000400000-0x0000000002B86000-memory.dmp
memory/4220-22-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-26-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-24-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-20-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-18-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-16-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-14-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-12-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-10-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-8-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-7-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-36-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-28-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-30-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-32-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-70-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-68-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-67-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-64-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-63-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-60-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-58-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-56-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-54-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-52-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-50-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-48-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-46-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-44-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-42-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-40-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-38-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-34-0x00000000072B0000-0x00000000072DC000-memory.dmp
memory/4220-958-0x0000000007F90000-0x0000000007FA2000-memory.dmp
memory/4220-957-0x0000000007960000-0x0000000007F78000-memory.dmp
memory/4220-959-0x0000000007FB0000-0x00000000080BA000-memory.dmp
memory/4220-960-0x00000000080E0000-0x000000000811C000-memory.dmp
memory/4220-961-0x0000000008150000-0x000000000819C000-memory.dmp
memory/4220-962-0x00000000048D0000-0x00000000048FB000-memory.dmp
memory/4220-963-0x0000000004900000-0x0000000004939000-memory.dmp
memory/4220-965-0x0000000000400000-0x000000000043C000-memory.dmp