Analysis

  • max time kernel
    110s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 20:18

General

  • Target

    a326981a61046004106b79cd4fd2735e5dd45d492cf07e8f2ed6d729d7b11df5N.exe

  • Size

    353KB

  • MD5

    c123926b7ffbf91951c13ecda65182a0

  • SHA1

    6d09fd31ba96b3b4a4eb3e10a1740cf8383b85dc

  • SHA256

    a326981a61046004106b79cd4fd2735e5dd45d492cf07e8f2ed6d729d7b11df5

  • SHA512

    dd3b88f19d54b899d81223cfb24e4b217022ced246f511b2e79a86f0422292d870495cdac7ee5a24e9fab7a43cf633a86232e46de44486e46f94f3a36bb3aba7

  • SSDEEP

    6144:ohubMBcCBYBTSDDPKxylSlohtwrcCSRaKQT5kTZtkjt:oYb4clS3PKxyl+ohtm+geGt

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a326981a61046004106b79cd4fd2735e5dd45d492cf07e8f2ed6d729d7b11df5N.exe
    "C:\Users\Admin\AppData\Local\Temp\a326981a61046004106b79cd4fd2735e5dd45d492cf07e8f2ed6d729d7b11df5N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2028

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2028-2-0x0000000002550000-0x000000000259B000-memory.dmp

          Filesize

          300KB

        • memory/2028-3-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB

        • memory/2028-1-0x0000000000890000-0x0000000000990000-memory.dmp

          Filesize

          1024KB

        • memory/2028-4-0x0000000000400000-0x000000000080D000-memory.dmp

          Filesize

          4.1MB

        • memory/2028-5-0x0000000002B00000-0x0000000002B46000-memory.dmp

          Filesize

          280KB

        • memory/2028-6-0x0000000004F20000-0x00000000054C4000-memory.dmp

          Filesize

          5.6MB

        • memory/2028-7-0x0000000005510000-0x0000000005554000-memory.dmp

          Filesize

          272KB

        • memory/2028-9-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-11-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-71-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-49-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-8-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-69-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-67-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-65-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-63-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-61-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-59-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-57-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-55-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-53-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-51-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-47-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-46-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-43-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-41-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-40-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-37-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-35-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-33-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-31-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-29-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-27-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-25-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-23-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-21-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-19-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-17-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-15-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-13-0x0000000005510000-0x000000000554F000-memory.dmp

          Filesize

          252KB

        • memory/2028-914-0x0000000005580000-0x0000000005B98000-memory.dmp

          Filesize

          6.1MB

        • memory/2028-915-0x0000000005C20000-0x0000000005D2A000-memory.dmp

          Filesize

          1.0MB

        • memory/2028-916-0x0000000005D60000-0x0000000005D72000-memory.dmp

          Filesize

          72KB

        • memory/2028-917-0x0000000005D80000-0x0000000005DBC000-memory.dmp

          Filesize

          240KB

        • memory/2028-918-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

          Filesize

          304KB

        • memory/2028-919-0x0000000000890000-0x0000000000990000-memory.dmp

          Filesize

          1024KB

        • memory/2028-920-0x0000000002550000-0x000000000259B000-memory.dmp

          Filesize

          300KB

        • memory/2028-921-0x0000000000400000-0x000000000044E000-memory.dmp

          Filesize

          312KB