Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 06:00

General

  • Target

    75c8af671a326cc65216a332f81223343736874ddd717fe2ae25ed4a49db4446.exe

  • Size

    397KB

  • MD5

    b227006bde63edc7493acb0ba4b9393e

  • SHA1

    53b802103842cf24080f528f5412637ff26c22b9

  • SHA256

    75c8af671a326cc65216a332f81223343736874ddd717fe2ae25ed4a49db4446

  • SHA512

    502d4644dfea62796e7dd7d3779a40d520e2cd0c94ddfd4fa35f18007ba410fa1d0296445d0065b1cf6f4edc801561dc02b451fd408e2ff8e70207fb0befbc81

  • SSDEEP

    6144:g/Br34ad7Mhou5p034iK769u5iha3xt9iJlcpwK5zd7:wBpNMhrp039j9Qiha3xt9IcpwK5B

Malware Config

Extracted

Family

redline

Botnet

170

C2

45.9.20.240:46257

Attributes
  • auth_value

    73f905977a8199ea3d396a0a7d0ae6c8

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75c8af671a326cc65216a332f81223343736874ddd717fe2ae25ed4a49db4446.exe
    "C:\Users\Admin\AppData\Local\Temp\75c8af671a326cc65216a332f81223343736874ddd717fe2ae25ed4a49db4446.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2472

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2472-1-0x0000000000510000-0x0000000000610000-memory.dmp

          Filesize

          1024KB

        • memory/2472-2-0x00000000020F0000-0x0000000002129000-memory.dmp

          Filesize

          228KB

        • memory/2472-3-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2472-4-0x0000000000400000-0x00000000004E5000-memory.dmp

          Filesize

          916KB

        • memory/2472-5-0x0000000002610000-0x0000000002644000-memory.dmp

          Filesize

          208KB

        • memory/2472-6-0x0000000004D40000-0x00000000052E4000-memory.dmp

          Filesize

          5.6MB

        • memory/2472-7-0x0000000004BF0000-0x0000000004C22000-memory.dmp

          Filesize

          200KB

        • memory/2472-13-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-19-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-71-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-69-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-67-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-65-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-964-0x0000000005910000-0x0000000005A1A000-memory.dmp

          Filesize

          1.0MB

        • memory/2472-965-0x0000000005A20000-0x0000000005A5C000-memory.dmp

          Filesize

          240KB

        • memory/2472-966-0x0000000005A80000-0x0000000005ACC000-memory.dmp

          Filesize

          304KB

        • memory/2472-963-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

          Filesize

          72KB

        • memory/2472-962-0x00000000052F0000-0x0000000005908000-memory.dmp

          Filesize

          6.1MB

        • memory/2472-63-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-61-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-60-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-57-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-55-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-53-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-51-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-49-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-47-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-45-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-43-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-41-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-39-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-35-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-33-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-31-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-29-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-27-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-25-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-23-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-22-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-17-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-16-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-37-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-11-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-9-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-8-0x0000000004BF0000-0x0000000004C1D000-memory.dmp

          Filesize

          180KB

        • memory/2472-967-0x0000000000510000-0x0000000000610000-memory.dmp

          Filesize

          1024KB

        • memory/2472-968-0x00000000020F0000-0x0000000002129000-memory.dmp

          Filesize

          228KB

        • memory/2472-969-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB