Resubmissions

10-11-2024 21:28

241110-1bhk6avgrr 10

Analysis

  • max time kernel
    1281s
  • max time network
    1329s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 02:47

General

  • Target

    0c1e5acd77d667335c59b10f7bd08997ff5bac4aeb52722fffe17c60d1779553.exe

  • Size

    371KB

  • MD5

    341944954703c303537b9d8aa25e5531

  • SHA1

    836351bd41f31d10209d0bdab117186d86071816

  • SHA256

    0c1e5acd77d667335c59b10f7bd08997ff5bac4aeb52722fffe17c60d1779553

  • SHA512

    9fc832dbd848b6fba32e5beca85e7e55e385f677739ce4372d3cd76a3b05d044e1cb4edbae3fda7eadd185803359642fef50ea8691ae488d8d7dce19eca99073

  • SSDEEP

    6144:Ic/RLyHWHs8c5LRMuPpucS5YUhb7jRXBsL36vAiVMaY/6V:Ic/R2HsIMuo5YUNNX4U1VM

Malware Config

Extracted

Family

redline

Botnet

Dozkey

C2

91.212.166.17:47242

Attributes
  • auth_value

    c06f8f31502cdaf6d673db7589189fd5

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c1e5acd77d667335c59b10f7bd08997ff5bac4aeb52722fffe17c60d1779553.exe
    "C:\Users\Admin\AppData\Local\Temp\0c1e5acd77d667335c59b10f7bd08997ff5bac4aeb52722fffe17c60d1779553.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4872-1-0x0000000000910000-0x0000000000A10000-memory.dmp

    Filesize

    1024KB

  • memory/4872-2-0x0000000000870000-0x00000000008C8000-memory.dmp

    Filesize

    352KB

  • memory/4872-3-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/4872-4-0x0000000000400000-0x00000000005BB000-memory.dmp

    Filesize

    1.7MB

  • memory/4872-5-0x0000000002740000-0x000000000278C000-memory.dmp

    Filesize

    304KB

  • memory/4872-6-0x0000000004D10000-0x00000000052B4000-memory.dmp

    Filesize

    5.6MB

  • memory/4872-7-0x0000000005300000-0x0000000005348000-memory.dmp

    Filesize

    288KB

  • memory/4872-59-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-67-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-71-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-69-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-65-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-63-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-61-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-57-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-55-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-54-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-51-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-49-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-48-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-43-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-41-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-39-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-37-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-35-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-33-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-31-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-29-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-27-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-25-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-23-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-21-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-19-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-17-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-13-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-800-0x0000000005350000-0x0000000005968000-memory.dmp

    Filesize

    6.1MB

  • memory/4872-801-0x00000000059E0000-0x00000000059F2000-memory.dmp

    Filesize

    72KB

  • memory/4872-9-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-8-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-45-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-15-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-11-0x0000000005300000-0x0000000005344000-memory.dmp

    Filesize

    272KB

  • memory/4872-802-0x0000000005A00000-0x0000000005B0A000-memory.dmp

    Filesize

    1.0MB

  • memory/4872-803-0x0000000005B10000-0x0000000005B4C000-memory.dmp

    Filesize

    240KB

  • memory/4872-804-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

    Filesize

    304KB

  • memory/4872-805-0x0000000000910000-0x0000000000A10000-memory.dmp

    Filesize

    1024KB

  • memory/4872-806-0x0000000000870000-0x00000000008C8000-memory.dmp

    Filesize

    352KB

  • memory/4872-807-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB