Analysis

  • max time kernel
    106s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 02:22

General

  • Target

    85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946N.exe

  • Size

    168KB

  • MD5

    775563c9eca8c6a1b32eb63fad486b70

  • SHA1

    a6ff62e678d34aeaf241acc4403e6fc32f6cd12c

  • SHA256

    85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946

  • SHA512

    79df64dcf3d6f6d0f5943240629af4e1ffa1368800f7492ed02d5b5b62990cf40db8ad41f1eeb9c6af9760b23fb977a5f7bb8f5c6e8fb27f0d16671c27704c1a

  • SSDEEP

    3072:uJaohQaSe5clFcb0iCKbqVsTQZxTcVL8e8h2:uJteaSe5clhiVwxTcVL

Malware Config

Extracted

Family

redline

Botnet

mazda

C2

217.196.96.56:4138

Attributes
  • auth_value

    3d2870537d84a4c6d7aeecd002871c51

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946N.exe
    "C:\Users\Admin\AppData\Local\Temp\85644a9475c7c124a8e4b677432d193ffab0481bb84b83a680d18a4a273c2946N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:5072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5072-0-0x000000007527E000-0x000000007527F000-memory.dmp

    Filesize

    4KB

  • memory/5072-1-0x00000000004E0000-0x0000000000510000-memory.dmp

    Filesize

    192KB

  • memory/5072-2-0x0000000002920000-0x0000000002926000-memory.dmp

    Filesize

    24KB

  • memory/5072-3-0x000000000A9A0000-0x000000000AFB8000-memory.dmp

    Filesize

    6.1MB

  • memory/5072-4-0x000000000A490000-0x000000000A59A000-memory.dmp

    Filesize

    1.0MB

  • memory/5072-5-0x000000000A3B0000-0x000000000A3C2000-memory.dmp

    Filesize

    72KB

  • memory/5072-6-0x000000000A410000-0x000000000A44C000-memory.dmp

    Filesize

    240KB

  • memory/5072-8-0x0000000075270000-0x0000000075A20000-memory.dmp

    Filesize

    7.7MB

  • memory/5072-7-0x0000000002890000-0x00000000028DC000-memory.dmp

    Filesize

    304KB

  • memory/5072-9-0x000000007527E000-0x000000007527F000-memory.dmp

    Filesize

    4KB

  • memory/5072-10-0x0000000075270000-0x0000000075A20000-memory.dmp

    Filesize

    7.7MB