Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 02:11
General
-
Target
c7c4c70180910686c9799b40504537197e79e3e28b0bdadb250c7f2a4732fc85.exe
-
Size
437KB
-
MD5
1b88103925130e6a46a54be5fd28dbc0
-
SHA1
d0373944ab2663ab42e99003415dbab34b275dd9
-
SHA256
c7c4c70180910686c9799b40504537197e79e3e28b0bdadb250c7f2a4732fc85
-
SHA512
407bce4d2fdc851a3ca50b30de42ddf288004c01fea7fe3c30085bf1f986c47c4f9f0bc9b537d9c6806513f3aba0acc45d27b9fe5d3a1af9b707fbee88b280d2
-
SSDEEP
6144:K9y+bnr+Op0yN90QEoJhy8+VfE6BpNW7J4Ul6LZBfFwtxu0aUApibmurrZLXYOuU:nMrWy90VxDpY7mEABfobaUyCZ7YOIER
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c4c70180910686c9799b40504537197e79e3e28b0bdadb250c7f2a4732fc85.exe"C:\Users\Admin\AppData\Local\Temp\c7c4c70180910686c9799b40504537197e79e3e28b0bdadb250c7f2a4732fc85.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lNb25LR23.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lNb25LR23.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD5cfe8a5405f2bdada5dafe1bbb5ee9bb3
SHA147181695c79c2b81225a4d24d5b00e003eefd4d7
SHA256b6d33effef48b43f1cdbdd4072aaec30084436366c198f15594dda349b5ed84b
SHA5125b3dace50da121ef0d3c2aaaf5003dd79935e8cade05fc406c24509ce516e06522afb7bd1836136d1f7b3e31c7ac212c53c63105af952c58db70f8907d56a63c
-
Filesize
1024KB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
312KB