Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-11-2024 04:54
General
-
Target
f1fa728270e9987a99db1d520ae61c3e05703445c5867c8ecc52b768608653c0.exe
-
Size
660KB
-
MD5
0c7236df17f350afcf62339053ac91d3
-
SHA1
979141cadb1ae6444812b1ae4df6a6b8668f7945
-
SHA256
f1fa728270e9987a99db1d520ae61c3e05703445c5867c8ecc52b768608653c0
-
SHA512
fce02d0f7bdaea6cad39b9bac5bf19fffdffd98815d04a3912d3aeea369e5ebe522be5a93eeba0946528c11d1d4a381c542e38317ba6b7fd635b6567729b1ec1
-
SSDEEP
12288:TMrZy90WMmPQGktxw3OyxrCZtVoG5uD6wJw7u6tF/MB:SyyAQzxw3OgCZtVoGgDdw7u68
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1fa728270e9987a99db1d520ae61c3e05703445c5867c8ecc52b768608653c0.exe"C:\Users\Admin\AppData\Local\Temp\f1fa728270e9987a99db1d520ae61c3e05703445c5867c8ecc52b768608653c0.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vnA70.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vnA70.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dmi76.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dmi76.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516KB
MD558d00454dcf7c63a6784cf0994c4e55c
SHA1c809dbdccebdbbf7ce5ce2db6c4fba41c977dca8
SHA256a3844ca201d16aa7143e08fede624dd25d09482a6a4abd7d82d3436aca0bebdd
SHA512130dd4e2c617f74e4ad93d2935882b4398eb5ed0701176c709b87cba7a2295af792255b6a727a3d869182abecc6edece00dbc42e67d5f53eeca7a40dd3f33b99
-
Filesize
296KB
MD51fac68ff822048c7d438408c40af955b
SHA18f6728720ee05f7972d7a5e99b3a71703e0e7db7
SHA25659175875cc49dbb1ebfd537ce345fd24462a5befdbbc81983acd164842966214
SHA512631887b4a57c30e7c25bf587f335b01cd3b12a9ba63cacc4f96fe313e93ee7039ece1d390a12d6ce62ee7f598b7c98a7debe72d686bcdbb53628d21f6d8d1dcc
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
3.6MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
312KB