Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-11-2024 10:56
General
-
Target
4ecf3f6da745d90f98134512bfb0ab0513086ce2fce33fbce968a80150ea61d3.exe
-
Size
509KB
-
MD5
67a1a7cae6ea3b65bfd86312c65b2c50
-
SHA1
37e7729ae113353602a9798b3a14c13c6f669178
-
SHA256
4ecf3f6da745d90f98134512bfb0ab0513086ce2fce33fbce968a80150ea61d3
-
SHA512
da06322dcd2c7ea86148f731c10aa929b03178e0591e34338f2cca54204fb979d22d3fdd383cd244578b790cfc9ab9e8cad50c948d7c4b391cd94a4163b8677d
-
SSDEEP
12288:9MrBy902861He/LJinMYsbvnIm4GZTZVAJ+5:0y38IHiLDzjIzaZOJ6
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ecf3f6da745d90f98134512bfb0ab0513086ce2fce33fbce968a80150ea61d3.exe"C:\Users\Admin\AppData\Local\Temp\4ecf3f6da745d90f98134512bfb0ab0513086ce2fce33fbce968a80150ea61d3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dyV94.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dyV94.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
281KB
MD51b3f6a341b4fa013cf3f377b3ef4f6f8
SHA1a6cf129e55830409609df13609f2656774809e20
SHA2567dab4b2c0841de1211db5d5f75e86c72efdf53fd445d4ccde2dc47f41d1ae65c
SHA512b0c2b67f97cbdb58964a34de534c1c124e3566b1292c8994d7458bfb9372eeeab88f9537bf668865dcf4fba82d467149e24c830d5d8e7362c5b10ae125387417
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
3.6MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
312KB