Analysis
-
max time kernel
110s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-11-2024 06:12
General
-
Target
a81972d22bbec6d5d7a194144907b7af3582920740dd262e75ad2f1498778f33N.exe
-
Size
583KB
-
MD5
763f94bb2d757bfb041fa56f6844ed20
-
SHA1
ecaa536a49f57cfa3f4abbe167cd8c3301c6d2d7
-
SHA256
a81972d22bbec6d5d7a194144907b7af3582920740dd262e75ad2f1498778f33
-
SHA512
7e24d57735e15a68ebed02ceaab485b588d968ea788470fc7603a1f57a537c18acd48884fd9add42b28ff6d789b4248adbc4c12dedc796161d229a7c3f1f7173
-
SSDEEP
12288:8MrOy9033s5s9CRNv5HjbmclwkLwKi5cBWDmAmX74kN:SyKc5s9Ov5Hjbpfi5jmJVN
Malware Config
Extracted
redline
ronam
193.233.20.17:4139
-
auth_value
125421d19d14dd7fd211bc7f6d4aea6c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81972d22bbec6d5d7a194144907b7af3582920740dd262e75ad2f1498778f33N.exe"C:\Users\Admin\AppData\Local\Temp\a81972d22bbec6d5d7a194144907b7af3582920740dd262e75ad2f1498778f33N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nbK36VY20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nbK36VY20.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\evq49tF.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\evq49tF.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439KB
MD593d7995a7a8e36c5cb4e1c5dbb79b85d
SHA154ee45b6d665d2fd4d6a3ac90fdb328db961e93b
SHA256f27d60940eae68cd1f2654da255d579e423214f6c58e8c49e5f8fb88a1527e88
SHA5125eba5b9fc4e7f8d91fea29320d26a02d3e5bff1f6aa07f02f5145aa529aaad619cc696b5667e0ef0ac650a8c0ed96b9bec4bba30b34ee6d64ceabcc1bbdeb177
-
Filesize
302KB
MD53ae325b7e23ade83ec4a82f60599bbd2
SHA15dc22cc013fc250e419ac826ef7cb1fcb3728ef5
SHA256271a51784a7210356ba70dfd7e82d0c7c46316b6911925e1e6c955d5b3ecaa74
SHA512a10c5bc435513e0583d9e5227347e1e62a5b1a6a25116f3a609b8d93d797c402ecc88041156f337b66ead158d9fe1a0000b71c1f114efd14c95d28cc26e026d3
-
Filesize
1024KB
-
Filesize
312KB
-
Filesize
300KB
-
Filesize
2.2MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
312KB