Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/11/2024, 06:05
General
- Target 72326770d1bd755efcb842041a772b6f5eb4c3c96362b1455c6274d837a48f49.exe
- Size 351KB
- Sample241111-gtk98avcrd
- SHA256 72326770d1bd755efcb842041a772b6f5eb4c3c96362b1455c6274d837a48f49
Malware Config
Extracted
-
redline
-
@2023@
-
193.106.191.138:32796
-
auth_value
ca057e5baadfd0774a34a6a949cd5e69
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72326770d1bd755efcb842041a772b6f5eb4c3c96362b1455c6274d837a48f49.exe"C:\Users\Admin\AppData\Local\Temp\72326770d1bd755efcb842041a772b6f5eb4c3c96362b1455c6274d837a48f49.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1068-1-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1068-2-0x0000000000930000-0x000000000097B000-memory.dmp
memory/1068-3-0x0000000000400000-0x000000000044E000-memory.dmp
memory/1068-4-0x0000000000400000-0x0000000000474000-memory.dmp
memory/1068-5-0x00000000023A0000-0x00000000023E6000-memory.dmp
memory/1068-6-0x0000000004B90000-0x0000000005134000-memory.dmp
memory/1068-7-0x0000000004A60000-0x0000000004AA4000-memory.dmp
memory/1068-8-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-33-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-71-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-69-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-67-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-65-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-63-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-61-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-57-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-55-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-53-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-51-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-49-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-47-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-45-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-43-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-39-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-37-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-35-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-31-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-29-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-27-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-25-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-23-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-21-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-19-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-15-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-13-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-59-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-41-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-17-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-11-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-9-0x0000000004A60000-0x0000000004A9E000-memory.dmp
memory/1068-914-0x0000000005810000-0x0000000005E28000-memory.dmp
memory/1068-915-0x00000000076D0000-0x00000000077DA000-memory.dmp
memory/1068-916-0x0000000006050000-0x0000000006062000-memory.dmp
memory/1068-917-0x0000000006070000-0x00000000060AC000-memory.dmp
memory/1068-918-0x00000000060C0000-0x000000000610C000-memory.dmp
memory/1068-919-0x0000000000730000-0x0000000000830000-memory.dmp
memory/1068-920-0x0000000000930000-0x000000000097B000-memory.dmp
memory/1068-921-0x0000000000400000-0x000000000044E000-memory.dmp