Analysis
-
max time kernel
111s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-11-2024 13:25
General
-
Target
176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe
-
Size
733KB
-
MD5
05aae5136d9f4541dafc2d66ac3b9089
-
SHA1
ba413e61e05edd8d91512103f4eea3db8a0ebb36
-
SHA256
b6683ae4d7f9b2aebf316c239ce5fc7d9cc1da774a68be5503e3f00e43b72668
-
SHA512
1b17aa23576177b528b7779fbd15b671d71d474ec9fbb7139ae37bbcb0024c01773824fc3fe78590dbf344b92c27fd3690d9ed210c08e4d074866a1a2c99ecb6
-
SSDEEP
12288:NMrKy90WGUha0TiyFqnaUW8DSV6VRVs7Nq9Xgyf6vZ7gtVjCH1TSNGDF0g/6M0rr:jyxa0TtqnHXDSV6xsI9Xgb9gfCVTSUnS
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe"C:\Users\Admin\AppData\Local\Temp\176fe315f0a20bf029b56934e5f7bef9c0f93f37a46f6db369fe9d56d0b32176N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSO32.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSO32.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dKp28.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dKp28.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD5845059f2de1914f6714e4556b13a9bc8
SHA1bddef6e6feb852ce3fb2fdc46d58cb1242a074a2
SHA25605bb1f2daf53a35f345d08436307293133373e124524a69cc817dd1261551683
SHA512ea88e0c2dcddbd52500a5621bc0b8e37bf9d021bc063d6b4a3efb4272f7204fbb45fe68fc1560fa31ef3420ec667fbc109148f658eca88de9973b0b3d113c232
-
Filesize
473KB
MD54935a1c3f7b324d4181b56458d1d2e07
SHA1f7773acb609d2865fd852f29d05f7ee698c1a4c3
SHA256da5ee96b2a068b7258c34264c5f8f545f982b34dcafc4ae7c209eceb53f80607
SHA5122a7845cc02ff8cc0f6659a6a13c0051c15bb6153b4189004ed5c996b5b1efd3a6bf00f62d729a8af8be1b4925b9f835c01027d1ea5937876752e451cd91c268c
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
532KB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB