Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 22:28
General
-
Target
cb36737ab3399bd6ef76bdf5c3c441ed0c940ea5730f038b79c7fd31ce1d1fb8.exe
-
Size
583KB
-
MD5
288aa32d7f130b0fbf5ad485d4462a0f
-
SHA1
8e1d2e7e22bdd94b7763a302d76e0a25ef10b362
-
SHA256
cb36737ab3399bd6ef76bdf5c3c441ed0c940ea5730f038b79c7fd31ce1d1fb8
-
SHA512
ffdd492bd8c68cbbaf54ca96411b8acae505e889646f8c9cdec4606afce552677bb58bbf3daa5cce44a5686888662dbf12dc4a19c8ca6fae7b1c88ba435316d3
-
SSDEEP
12288:EMrSy90cYYfSuQvTh/n6hHiLO4m5LsVw51Fa/NA6cL/:myNGuQ7B6MK4mVPa/NA6cz
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb36737ab3399bd6ef76bdf5c3c441ed0c940ea5730f038b79c7fd31ce1d1fb8.exe"C:\Users\Admin\AppData\Local\Temp\cb36737ab3399bd6ef76bdf5c3c441ed0c940ea5730f038b79c7fd31ce1d1fb8.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxp0617.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxp0617.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\naA14xj.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\naA14xj.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
438KB
MD5dd09fa9a2efa9415d366a5526098cd6b
SHA1701607d7f31ee7ba6a8a7f9ac39bdf1f8801dac8
SHA256958b68448bf351a488e3612d8082bb0cd7e0080b0ea32abc37f69a8c8f1715cd
SHA512345d09fbce1a1daa5b315bbd090eb27245f19e80206fcebc53d3de79e5e3d8b4527d961d33b20498bc58abc156c5a7372ebc72af0d723c718314fbdd615d8158
-
Filesize
301KB
MD514abded4bca9025d4ba907c63103456c
SHA1873758a6effd5c19506217f951a4e69d04bb7c4c
SHA256184c67989178ff386cf56557a3a6a72def613633fe3c8f0aed21f0258052face
SHA512bac83e17b928c0663cb1e9e5153d4fb903e74d862f87dbf44b3c0ca46afe6c0daae25dcbc9ebe4aac4cd6512aa730fcc9e22bc3582c83f1a04e9a32f044323d3
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
2.2MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB