Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 00:54
General
-
Target
2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30.exe
-
Size
739KB
-
MD5
15d5e3180cdd4ecd84fb126c22842382
-
SHA1
b24d584f33be42b9ec909c84da5722ffa9e2f82f
-
SHA256
2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30
-
SHA512
e6bd03d60c9a9df23b6af1313972f8094f41fcfdb87633a725e450ea79eb6ac72b60ee966414215361d34bf804b879de1671c473a34621c02f69e6b505be58a5
-
SSDEEP
12288:VMrNy902AC4CiE7uYBco+AeGdtolfQxOEU87IuqQ0mvh0L2u8T:4yV7uPVhlfQxOEL8u1vM2uW
Malware Config
Extracted
redline
ruma
193.233.20.13:4136
-
auth_value
647d00dfaba082a4a30f383bca5d1a2a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30.exe"C:\Users\Admin\AppData\Local\Temp\2265eacd76517f77ebb7007876656dd0153ca63e515158509cda25a128985a30.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vPj26.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vPj26.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\voi76.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\voi76.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drb85.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\drb85.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD5960c7e329238c16ce5045f17c65f6125
SHA16cc801e4719bcfcf3c4c21d682ddef561ad0cd30
SHA256e299cce3c7f2bf06e596f72865c40d6878897c95952cb20430edba016efa7348
SHA512f30acefe90cf2bbfc6737d31bb377fc705d8996135e27d97668cdb609ba1bfd541d27c734e1a61b6214b7c19b26a249764317b7389bb1873e4248dfa4325348e
-
Filesize
491KB
MD59290384a13a8e092f3cba2040f3264ba
SHA1a2e064af02d3400a26eafcd35d97e761c121199b
SHA25655f52c2bf7735f6d9a97f4bb255a341f562b92d35b62f3633b18dce6ccda0f15
SHA512d791d9ba6e722ba70464afcf4e71bd30f03f7c1aadf9895aaa2faa399cc8bdab72607fd065ad77a85df35080cbfaf6e973fcefb07219596c44947492a85afe15
-
Filesize
293KB
MD5b5b088e47af91c344e3583ef9391586f
SHA181c28284f693f66d1d30b8ee09f0d69e27457333
SHA2563f201ce75b624c56d73e6aa11e0d93825455d0ee88d3fdcc8e2f3bafae6cc739
SHA5129d0789dfa16b849709e3bb04159ed2bf6ccd74975472efe87aeb9d8ff0539b8953cb0937b4d646fba7d1460ea8c1fd0ee4dfb9ec2debfefdee70ab9b05ca1a3b
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB