Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 02:48
General
-
Target
717cfb41978f551038326e835c16fa8b5f3283a2a2904e2d4a84e8c19ad5b14a.exe
-
Size
510KB
-
MD5
28c5064542849e7a1dcd54e31a9eda5f
-
SHA1
296e93fad7c29dfa957b7d4005b79e95b9941364
-
SHA256
717cfb41978f551038326e835c16fa8b5f3283a2a2904e2d4a84e8c19ad5b14a
-
SHA512
686505b1a27cb2d6d62c2b3f78bdd6588daa70e8215a78363dbd0dd2112eb5a52352d2a0259c3d493dbac38a3082feb3a2f622673f1adc707d333d08fb61c519
-
SSDEEP
12288:oMray90ax2MZODIBX2m1xgqM1Ck32dQ31E/MB:yyz2ME4yB732O31wMB
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\717cfb41978f551038326e835c16fa8b5f3283a2a2904e2d4a84e8c19ad5b14a.exe"C:\Users\Admin\AppData\Local\Temp\717cfb41978f551038326e835c16fa8b5f3283a2a2904e2d4a84e8c19ad5b14a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dfo67.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dfo67.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286KB
MD5a6472176d6df8701df40241e39f522a3
SHA1db006a222ee46214c2dd0b32b4111b1e8cdd81b1
SHA2566a5ff7ebac804f9557696fec939bc41169382c23e35fb8f576f37538d8592bde
SHA512ce8de087f81086b6f3c94bfcdd82632aec3dd57552c2e6e245b448b07ae1e2c38908ee0ef0db7c2697e3ed9ad0261ab670c2cfa8a9b15b37abde8429f35d6ba3
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
3.6MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB