redline | 990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8

Analysis

max time kernel
91s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8.exe
Size 272KB
Sample241110-thb9dstkdm
SHA256 990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8
MD5 6e156c4d5102776b88fe2580e79711d4
SHA1 5f1dd5ed0cf73c99b56c71f4f169c7fb2e201231
SHA512 d45ec2a3147f7f7028c52bc47378ab2b38cafbe6e70580dda2cc826971996c3cf8d7f70ab4948f90d42550ed53e2804b2642a578e6488ae90c87cc229db3249f
SSDEEP 3072:B6jIELf6FDTCLkYxJw6qxYgcgpiiSo40jm8dAhTrnz5XD1NxNn2pU9f2MKTV/wig:B6jodYx9cYKpzwAAh3nz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline ruma discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

ruma

193.233.20.13:4136

Attributes

auth_value
647d00dfaba082a4a30f383bca5d1a2a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3536-1-0x0000000000EC0000-0x0000000000F04000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8.exe

C:\Users\Admin\AppData\Local\Temp\990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8.exe
"C:\Users\Admin\AppData\Local\Temp\990f50882c05d7f013f97596dfb7714d97860e79fac15a53dd5ed9918395d0b8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3536-0-0x00000000752CE000-0x00000000752CF000-memory.dmp

Download

memory/3536-1-0x0000000000EC0000-0x0000000000F04000-memory.dmp