Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 22:06
General
-
Target
4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8.exe
-
Size
437KB
-
MD5
8ba50147a0d3befc1eda0e7a8ec6cb51
-
SHA1
eee12bc723170a0413ea1f22323fe97e0ea035e0
-
SHA256
4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8
-
SHA512
057276758f3209fb20badd1a9edb6aff3876fd0c2eedb017723602ccaca23b0f3a66d47fc96adc8747643ceacec87801f025bc9c467542a18135759defcf30fd
-
SSDEEP
12288:1Mrty907XcQk3o8HSfpzV+/Hu6Ky6GusYDU:wygmbSfpZ+/u6KVGusYDU
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8.exe"C:\Users\Admin\AppData\Local\Temp\4a7e86c971caf008170de451f875b99a6b124dbb606acc82a223a1e31df92ab8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eyh96eR53.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\eyh96eR53.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
Filesize
312KB
-
Filesize
300KB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
5.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
304KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB