Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 22:29
General
-
Target
83b77cc8b30fe15803c2759046d3916e05739a4b4c90cc5b5a9d51ce39f6a321.exe
-
Size
564KB
-
MD5
dd796866e1d545a43f3b7b362528307d
-
SHA1
5a62c3041d9928c8992ff1b7ae27506b208ad710
-
SHA256
83b77cc8b30fe15803c2759046d3916e05739a4b4c90cc5b5a9d51ce39f6a321
-
SHA512
e01174d1e9465f39081f40f21b2afcdf09f69ce46714ae09385cab40dc0ca4606864d364e3ba75e19fdcc4ddec09b7d5960f79fb05a4239871dc78c31845cd1d
-
SSDEEP
12288:nMr9y90ZFKHhU0Flt2caD3RrQKvbwA/oTdQuNF:aytRIJ7bwfTNF
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83b77cc8b30fe15803c2759046d3916e05739a4b4c90cc5b5a9d51ce39f6a321.exe"C:\Users\Admin\AppData\Local\Temp\83b77cc8b30fe15803c2759046d3916e05739a4b4c90cc5b5a9d51ce39f6a321.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmY9995.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dmY9995.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nQt91Jw.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nQt91Jw.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
419KB
MD5d650ca1f468cc0e178b64fcccf4c2e02
SHA1ffb86208271546444e9b7eb91a5dd427dc282807
SHA256c02f69bf6a08f60ff212244701b52a15bef27e4052c9c04aae73526ae38bc483
SHA512c26423ec4573f67b46f45db04e6d0ed857c8252a16c50b28f42b7ca78bdb2eb2872b29ec5f63758bd7e3d364e3c44c9b7fd2d547259cad00183dc5ac61ab7165
-
Filesize
265KB
MD57a78f52edbea16ad7c9ba5d09f7aa32b
SHA1486aaf1b89a4dc78da8b73a75417d4d875efbe2a
SHA25600631c3b76c2cad95b50e997aa14945832db0283e512b7eac0229246a869b73b
SHA5120484461740ed7bfa0c11fbe7c2afc6db7984b892b086b0d36184d35f9baf3795d3ccdae14530813c11deaf33b73191e4477ff2004e99e1bde356a979bf40b550
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB