redline | 0e51347db50f84990e8d5f1d2b80206e79a17b9b1c955feb58402cfeeae878a8

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56983b563ee6fd037474c90c1678d5a81fe87588.exe
Size

318KB
MD5

482a19e311cebaaae2dd7d73cf223abf
SHA1

56983b563ee6fd037474c90c1678d5a81fe87588
SHA256

0e51347db50f84990e8d5f1d2b80206e79a17b9b1c955feb58402cfeeae878a8
SHA512

5d1d39dd6c523708b1839dc77ff5c55dd1b50ed54492c240f8eeb1b83f8ad9621acdde64b5d74c1c10558c0d3e260b45899a67810004ba6bda4faa0cd1a7d298
SSDEEP

6144:eUgLpjp90jrpL6sz42bqrJiZXU+lpEoZ2v3pCLT0mY0:eUg91qjrlJzCUZXU+7E3v5CLTJP

Score

10^/10

redline 123 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

123

78.153.144.3:2510

Attributes

auth_value
cd6abb0af211bce081d7bf127cc26835

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral2/memory/244-5-0x00000000027B0000-0x00000000027EE000-memory.dmp	family_redline
behavioral2/memory/244-7-0x0000000002830000-0x000000000286C000-memory.dmp	family_redline
behavioral2/memory/244-62-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-72-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-70-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-68-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-66-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-64-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-60-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-58-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-56-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-54-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-52-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-48-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-46-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-44-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-42-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-40-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-36-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-34-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-32-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-30-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-29-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-24-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-22-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-20-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-18-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-16-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-14-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-50-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-38-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-26-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-12-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-10-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline
behavioral2/memory/244-9-0x0000000002830000-0x0000000002866000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56983b563ee6fd037474c90c1678d5a81fe87588.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	56983b563ee6fd037474c90c1678d5a81fe87588.exe

C:\Users\Admin\AppData\Local\Temp\56983b563ee6fd037474c90c1678d5a81fe87588.exe
"C:\Users\Admin\AppData\Local\Temp\56983b563ee6fd037474c90c1678d5a81fe87588.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/244-1-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/244-2-0x00000000022F0000-0x000000000232E000-memory.dmp

Filesize
248KB

Download
memory/244-3-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/244-4-0x0000000000400000-0x00000000005A8000-memory.dmp

Filesize
1.7MB

Download
memory/244-5-0x00000000027B0000-0x00000000027EE000-memory.dmp

Filesize
248KB

Download
memory/244-6-0x0000000004EB0000-0x0000000005454000-memory.dmp

Filesize
5.6MB

Download
memory/244-7-0x0000000002830000-0x000000000286C000-memory.dmp

Filesize
240KB

Download
memory/244-8-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Filesize
584KB

Download
memory/244-62-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-72-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-70-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-68-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-66-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-64-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-60-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-58-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-56-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-54-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-52-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-48-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-46-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-44-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-42-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-40-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-36-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-34-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-32-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-30-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-29-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-24-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-22-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-20-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-18-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-16-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-14-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-50-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-38-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-26-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-12-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-10-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-9-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/244-1237-0x00000000055E0000-0x0000000005BF8000-memory.dmp

Filesize
6.1MB

Download
memory/244-1238-0x0000000005460000-0x000000000556A000-memory.dmp

Filesize
1.0MB

Download
memory/244-1239-0x0000000004E70000-0x0000000004E82000-memory.dmp

Filesize
72KB

Download
memory/244-1240-0x0000000005570000-0x00000000055AC000-memory.dmp

Filesize
240KB

Download
memory/244-1241-0x0000000005D00000-0x0000000005D4C000-memory.dmp

Filesize
304KB

Download
memory/244-1242-0x0000000000710000-0x0000000000810000-memory.dmp

Filesize
1024KB

Download
memory/244-1243-0x00000000022F0000-0x000000000232E000-memory.dmp

Filesize
248KB

Download
memory/244-1244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download