Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 23:40
General
-
Target
176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe
-
Size
733KB
-
MD5
543e695a6c46702e5d0edef1ec797230
-
SHA1
a9352c1779066038fc5143d498eba0ecc0598fcf
-
SHA256
176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176
-
SHA512
7c59100c9f7d8b2151ea460ebcc2ac83ef6852c53d91cbe97f60d4543598f1c4bce07bdab24e15fbf351f5e9e9f8c6f0d01f7e2d32b188e0c1ba592d88e2ac73
-
SSDEEP
12288:NMrKy90WGUha0TiyFqnaUW8DSV6VRVs7Nq9Xgyf6vZ7gtVjCH1TSNGDF0g/6M0rz:jyxa0TtqnHXDSV6xsI9Xgb9gfCVTSUnW
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe"C:\Users\Admin\AppData\Local\Temp\176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSO32.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSO32.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dKp28.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dKp28.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD5845059f2de1914f6714e4556b13a9bc8
SHA1bddef6e6feb852ce3fb2fdc46d58cb1242a074a2
SHA25605bb1f2daf53a35f345d08436307293133373e124524a69cc817dd1261551683
SHA512ea88e0c2dcddbd52500a5621bc0b8e37bf9d021bc063d6b4a3efb4272f7204fbb45fe68fc1560fa31ef3420ec667fbc109148f658eca88de9973b0b3d113c232
-
Filesize
473KB
MD54935a1c3f7b324d4181b56458d1d2e07
SHA1f7773acb609d2865fd852f29d05f7ee698c1a4c3
SHA256da5ee96b2a068b7258c34264c5f8f545f982b34dcafc4ae7c209eceb53f80607
SHA5122a7845cc02ff8cc0f6659a6a13c0051c15bb6153b4189004ed5c996b5b1efd3a6bf00f62d729a8af8be1b4925b9f835c01027d1ea5937876752e451cd91c268c
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
532KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB