Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/11/2024, 06:39
General
- Target 68182118d2d41de47320c732f4015bb4b94c5e4b.exe
- Size 310KB
- Sample241111-he3rdsykaq
- SHA256 f00c1ffacc3cfee266a453ff27e6717c15dd67515c494e7be3432a9ad1132046
Malware Config
Extracted
-
redline
-
123
-
78.153.144.3:2510
-
auth_value
cd6abb0af211bce081d7bf127cc26835
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\68182118d2d41de47320c732f4015bb4b94c5e4b.exe"C:\Users\Admin\AppData\Local\Temp\68182118d2d41de47320c732f4015bb4b94c5e4b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4684-1-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/4684-2-0x00000000022E0000-0x000000000231E000-memory.dmp
memory/4684-3-0x0000000000400000-0x0000000000441000-memory.dmp
memory/4684-4-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/4684-5-0x0000000004C00000-0x0000000004C3E000-memory.dmp
memory/4684-6-0x0000000004DE0000-0x0000000005384000-memory.dmp
memory/4684-7-0x0000000004C80000-0x0000000004CBC000-memory.dmp
memory/4684-8-0x0000000004CC0000-0x0000000004D52000-memory.dmp
memory/4684-38-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-48-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-72-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-70-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-66-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-64-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-62-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-60-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-58-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-56-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-52-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-50-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-46-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-44-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-42-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-40-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-36-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-34-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-32-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-30-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-28-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-26-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-24-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-22-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-20-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-18-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-68-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-54-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-16-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-14-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-12-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-10-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-9-0x0000000004C80000-0x0000000004CB6000-memory.dmp
memory/4684-1237-0x00000000055D0000-0x0000000005BE8000-memory.dmp
memory/4684-1238-0x0000000005400000-0x000000000550A000-memory.dmp
memory/4684-1239-0x0000000005530000-0x0000000005542000-memory.dmp
memory/4684-1240-0x0000000005550000-0x000000000558C000-memory.dmp
memory/4684-1241-0x0000000005CF0000-0x0000000005D3C000-memory.dmp
memory/4684-1242-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/4684-1243-0x00000000022E0000-0x000000000231E000-memory.dmp
memory/4684-1244-0x0000000000400000-0x0000000000441000-memory.dmp