Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 23:35
General
-
Target
e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914.exe
-
Size
632KB
-
MD5
11579075813469d9df2db396cf92f1de
-
SHA1
a8ceaafee8287239d20adc1039811a2a2184adf1
-
SHA256
e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914
-
SHA512
4ef1f905ad9d5f7d7d5325fbd74fb29c8cb03025046537cb1d090406181d7128e0bb0aafa3f9d625c30dcd9e076a62ea86445d9e4202cd92a0ce429039816b7c
-
SSDEEP
12288:/MrWy90mCKMsTM5vJl0CK5ZiEl6WnfB41vMIUDi:5y3CKMj6dmGp4WIUDi
Malware Config
Extracted
redline
bilod
193.233.20.7:4138
-
auth_value
407a8c8d5a1f9a3348afc8c6b0155512
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914.exe"C:\Users\Admin\AppData\Local\Temp\e3a315406a1e36ee63cc1953f99e6306c1fac8f66a7063d5e0672d56e97e6914.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cBrn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cBrn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aBrx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aBrx.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
445KB
MD5c59a7b24232ef6375403f4e3e29714c2
SHA1c4c1e8abf8795c23a55642b5f8a6fa9ea8c9cd32
SHA256d7013bac76b9d7cca809400afa295bc966cd40b09830dd2b9525470e0e236377
SHA5128b5260f00556fac613736e2cf12f0b93d81504e3a576c840c5a25e0fd7a3338c31252a7852629e39de61283f0e99ec3997c1899cd7638215bbfacdfbf4650b70
-
Filesize
406KB
MD5a3ea7ddc9568c1c7fc4bc205e0714a40
SHA1e8328c960e000c606b36a3887bc5d154afcfc141
SHA256b9592f7616249ff910d601c0680932abf55a8b4af511bf18d42ad55835f422d4
SHA512279e2caf4085de062f07efa10378fb010f382abb0c555b6f56c7439317b5fff7c8ab3a7646620b6e8834647acba78ee06cd5a4bd377dffc41303448c89dcbf8f
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
512KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB