Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/11/2024, 19:00
General
- Target a096a5e57f2f32b6409d503ef8e85876f2d69335b8dde082814fe2c16b68edf2.exe
- Size 325KB
- Sample241109-xnsecazfmn
- SHA256 a096a5e57f2f32b6409d503ef8e85876f2d69335b8dde082814fe2c16b68edf2
Malware Config
Extracted
-
redline
-
TripleSBanks
-
185.143.223.90:10024
-
auth_value
064872fe393e6f3a6d60eca59269d528
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a096a5e57f2f32b6409d503ef8e85876f2d69335b8dde082814fe2c16b68edf2.exe"C:\Users\Admin\AppData\Local\Temp\a096a5e57f2f32b6409d503ef8e85876f2d69335b8dde082814fe2c16b68edf2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4044-1-0x0000000000AA0000-0x0000000000BA0000-memory.dmp
memory/4044-2-0x0000000002580000-0x00000000025C1000-memory.dmp
memory/4044-3-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4044-4-0x0000000000400000-0x000000000091B000-memory.dmp
memory/4044-5-0x0000000002740000-0x000000000277C000-memory.dmp
memory/4044-6-0x00000000050D0000-0x0000000005674000-memory.dmp
memory/4044-7-0x0000000005050000-0x000000000508A000-memory.dmp
memory/4044-63-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-71-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-69-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-67-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-66-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-61-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-59-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-57-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-55-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-53-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-51-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-49-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-45-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-43-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-41-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-39-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-35-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-33-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-31-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-29-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-27-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-25-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-23-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-21-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-17-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-15-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-13-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-11-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-9-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-8-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-47-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-37-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-19-0x0000000005050000-0x0000000005084000-memory.dmp
memory/4044-962-0x0000000005DE0000-0x00000000063F8000-memory.dmp
memory/4044-963-0x0000000007CA0000-0x0000000007CB2000-memory.dmp
memory/4044-964-0x0000000007CC0000-0x0000000007DCA000-memory.dmp
memory/4044-965-0x0000000007E90000-0x0000000007ECC000-memory.dmp
memory/4044-966-0x0000000007F40000-0x0000000007F8C000-memory.dmp
memory/4044-967-0x0000000000AA0000-0x0000000000BA0000-memory.dmp
memory/4044-968-0x0000000002580000-0x00000000025C1000-memory.dmp
memory/4044-969-0x0000000000400000-0x0000000000444000-memory.dmp