Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 19:52

General

  • Target

    137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe

  • Size

    352KB

  • MD5

    7e914b9e0d4b4f88c8cffdda7f20757b

  • SHA1

    418b9af8a6f59458ed18324aeccda8543b6172e5

  • SHA256

    137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d

  • SHA512

    10ff03b0b53c40dfef6a67fdbb337665bc84faf02c94825196945acad54294b9381640eedaeaa5cedc590237eed0e3eaca4d597aa91b2241bfcc1bb15d1bfde0

  • SSDEEP

    6144:5byFigFct4ZGui6YGIX/aYtAt3XXOFhEuo/:5byIg+PGIaLt3XX

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe
    "C:\Users\Admin\AppData\Local\Temp\137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1800

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1800-1-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

          Filesize

          1024KB

        • memory/1800-2-0x0000000000230000-0x0000000000276000-memory.dmp

          Filesize

          280KB

        • memory/1800-3-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB

        • memory/1800-4-0x00000000046E0000-0x000000000471C000-memory.dmp

          Filesize

          240KB

        • memory/1800-5-0x0000000004770000-0x00000000047AA000-memory.dmp

          Filesize

          232KB

        • memory/1800-70-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-68-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-66-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-64-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-62-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-60-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-57-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-58-0x0000000000400000-0x0000000002BC2000-memory.dmp

          Filesize

          39.8MB

        • memory/1800-55-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-53-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-51-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-49-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-47-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-45-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-43-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-41-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-39-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-37-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-35-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-33-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-31-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-29-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-27-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-25-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-23-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-21-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-19-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-17-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-15-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-13-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-11-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-9-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-7-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-6-0x0000000004770000-0x00000000047A5000-memory.dmp

          Filesize

          212KB

        • memory/1800-799-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

          Filesize

          1024KB

        • memory/1800-800-0x0000000000230000-0x0000000000276000-memory.dmp

          Filesize

          280KB

        • memory/1800-801-0x0000000000400000-0x0000000000449000-memory.dmp

          Filesize

          292KB