Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 15:23

General

  • Target

    Redline_2021_stealer-main/Panel/RedLine_20_2/FAQ(RUS).docx

  • Size

    51KB

  • MD5

    aa9534a22d08fb17b6c50164ca226aba

  • SHA1

    9d68e6e4b0ea3c41ad7f70733dc53628962765ce

  • SHA256

    e3f9590d0a28e8f17d40f9a5a5489a963c6d5e722a324adf0d1d666ea424c89f

  • SHA512

    a4290cf0f3ecbb25078a0d3f870ed6abcab83d831e107f59730cf5fbdbc0268ac831d8f31f18a08794e27e51ba302ecb5bdd4bac85f3887844ed881c363bb8b9

  • SSDEEP

    1536:YmF2FkS3yM0Yj3ePetyogAcLrANZLI3dakgXeV:YNFkGem74Lr+k3v7V

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Panel\RedLine_20_2\FAQ(RUS).docx" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD98B.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    1a1cec9af45d65971853deb7b7f48328

    SHA1

    aed64b80458df2a6b4927fa074864a099c1fb055

    SHA256

    8c8ea671ee00ac99c7fa73157760c08788ab931d4523aafbecd9a19ef6293624

    SHA512

    f993a10b7c95b60a37781b84f363d93ee6dab00059259bf68c058f80fe900509290713091fd07e08e11b647a85db7be29be2a4a4905f68c9ade436e9f0a071e2

  • memory/4612-17-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-38-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-10-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-11-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-9-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-12-0x00007FF8BB7C0000-0x00007FF8BB7D0000-memory.dmp

    Filesize

    64KB

  • memory/4612-13-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-14-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-15-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-16-0x00007FF8BB7C0000-0x00007FF8BB7D0000-memory.dmp

    Filesize

    64KB

  • memory/4612-1-0x00007FF8BDBF0000-0x00007FF8BDC00000-memory.dmp

    Filesize

    64KB

  • memory/4612-6-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-22-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-20-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-19-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-21-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-8-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-7-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-5-0x00007FF8BDBF0000-0x00007FF8BDC00000-memory.dmp

    Filesize

    64KB

  • memory/4612-3-0x00007FF8FDC0D000-0x00007FF8FDC0E000-memory.dmp

    Filesize

    4KB

  • memory/4612-0-0x00007FF8BDBF0000-0x00007FF8BDC00000-memory.dmp

    Filesize

    64KB

  • memory/4612-18-0x00007FF8FDB70000-0x00007FF8FDD65000-memory.dmp

    Filesize

    2.0MB

  • memory/4612-4-0x00007FF8BDBF0000-0x00007FF8BDC00000-memory.dmp

    Filesize

    64KB

  • memory/4612-2-0x00007FF8BDBF0000-0x00007FF8BDC00000-memory.dmp

    Filesize

    64KB