Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/11/2024, 23:34
General
-
Target
5240e323c0200ff9042a192c21247469170536ac7567859c3794793d4bcd54c9.exe
-
Size
240KB
-
MD5
dbd9e663b170e15f14bdde8f3c024f01
-
SHA1
1e077653d36877bc283f0a2e4a715f6c1bc8d05c
-
SHA256
5240e323c0200ff9042a192c21247469170536ac7567859c3794793d4bcd54c9
-
SHA512
a44f1dda95e8ef9c7d0d1d64b9376baa879864d6df32e2850c63653ba5a34f8272f752a1aec32b62c0cfc00fdf90e0c38ddcac7b477caeb04deb5d1a38f63dcb
-
SSDEEP
3072:mjqTLgeXQHOuRFUMI6kxT2pp6rcpMVen6Xgoe/UY9JhT2ORu0P2X6Nfm:mjq/0OvH6kxyf6rcpMV2Jhru0uq
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
Server id Hgh
C2
185.183.35.100:44687
Attributes
-
auth_value
d734fe4464d4eb497d749f83aeb08e66
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5240e323c0200ff9042a192c21247469170536ac7567859c3794793d4bcd54c9.exe"C:\Users\Admin\AppData\Local\Temp\5240e323c0200ff9042a192c21247469170536ac7567859c3794793d4bcd54c9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
240KB