Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 10:59

General

  • Target

    307610abfc75e54db3dce8f7a2b2a4bfa08fc6a626b200f7529a9f764f85f313.exe

  • Size

    298KB

  • MD5

    cc4697c4565842da1f13a718a3141861

  • SHA1

    ffb4d9ef9bb8abe8500b2e9cc662f0a1328f3271

  • SHA256

    307610abfc75e54db3dce8f7a2b2a4bfa08fc6a626b200f7529a9f764f85f313

  • SHA512

    9a9a43f104e8b0d39939a8f5935cf82653df5b63a6f377660038f84f0d8ff39eaf4a43b219e911e89344138be6ee1b17f22a79f2f53b9c46605c729605e3260b

  • SSDEEP

    6144:52ECIjjW+LuLIe0T1eXwp8bXk3X4G1cmL2Gp2eT:5FCIjjW6vTHcmLxAe

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\307610abfc75e54db3dce8f7a2b2a4bfa08fc6a626b200f7529a9f764f85f313.exe
    "C:\Users\Admin\AppData\Local\Temp\307610abfc75e54db3dce8f7a2b2a4bfa08fc6a626b200f7529a9f764f85f313.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2480-0-0x0000000000220000-0x000000000024B000-memory.dmp

    Filesize

    172KB

  • memory/2480-1-0x0000000000250000-0x0000000000289000-memory.dmp

    Filesize

    228KB

  • memory/2480-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2480-3-0x0000000006E60000-0x0000000006E94000-memory.dmp

    Filesize

    208KB

  • memory/2480-4-0x0000000006E90000-0x0000000006EC2000-memory.dmp

    Filesize

    200KB

  • memory/2480-5-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/2480-9-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-23-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-29-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-27-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-25-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-21-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-19-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-17-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-15-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-13-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-11-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-7-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-47-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-6-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-41-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-45-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-49-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-59-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-69-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-67-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-65-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-63-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-61-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-57-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-55-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-53-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-51-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-43-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-39-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-37-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-35-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-33-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-31-0x0000000006E90000-0x0000000006EBC000-memory.dmp

    Filesize

    176KB

  • memory/2480-956-0x0000000000220000-0x000000000024B000-memory.dmp

    Filesize

    172KB

  • memory/2480-957-0x0000000000250000-0x0000000000289000-memory.dmp

    Filesize

    228KB

  • memory/2480-958-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB