Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 00:44
General
-
Target
54e7966bc2ed3fd91c6c62881c3efdb53b7f417661d45eef8cc3a789c6b69e43.exe
-
Size
440KB
-
MD5
d5935649a783936ef05cebdf7792b1b3
-
SHA1
f353114f8ca5775f7e2244f1da0d608455f761a6
-
SHA256
54e7966bc2ed3fd91c6c62881c3efdb53b7f417661d45eef8cc3a789c6b69e43
-
SHA512
d8e482b7cd3c606d4717d89f90515d2c495d4c9fc2d128d4e8e4c333a4ae4f8c805791254cd6ba6c0fa0b55932e925c93bc1b2589b8ebf63cf9c26783d07d0db
-
SSDEEP
12288:IMrYy90I9yZbmga3v2210xZA4XBbouCjChkym:AyP9wOgVX9oa5m
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54e7966bc2ed3fd91c6c62881c3efdb53b7f417661d45eef8cc3a789c6b69e43.exe"C:\Users\Admin\AppData\Local\Temp\54e7966bc2ed3fd91c6c62881c3efdb53b7f417661d45eef8cc3a789c6b69e43.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lUY60vH.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lUY60vH.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD5c3d22a0bfee7c3690cd8530a7f33eada
SHA148abea16fd96f396d7ac4ef747a4daf02e6418c2
SHA2562040c922cb52c57b07ca4b2496494bb14035aed17ba72d414f2bdcf401ef9a8b
SHA5129cd197f74d28cbc6defa6a35e49754a0f919c54d7c8e59b40eb3879a95c90858c77ccb897198d7c6c992c1b236f91fa84d7ba9450063b1151cde3625e8f59047
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB