Analysis
- max time kernel
111s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 12:24
General
- Target 140601c126ef041f2f82048f78637c73c004a3c6f02044ed7144d377ea8dcbda.exe
- Size 461KB
- Sample241113-plfnrsscjq
- SHA256 140601c126ef041f2f82048f78637c73c004a3c6f02044ed7144d377ea8dcbda
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\140601c126ef041f2f82048f78637c73c004a3c6f02044ed7144d377ea8dcbda.exe"C:\Users\Admin\AppData\Local\Temp\140601c126ef041f2f82048f78637c73c004a3c6f02044ed7144d377ea8dcbda.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1412-1-0x0000000000980000-0x0000000000A80000-memory.dmp
memory/1412-2-0x0000000002420000-0x0000000002466000-memory.dmp
memory/1412-3-0x0000000000400000-0x0000000000449000-memory.dmp
memory/1412-4-0x0000000000400000-0x0000000000817000-memory.dmp
memory/1412-5-0x0000000002A10000-0x0000000002A4C000-memory.dmp
memory/1412-6-0x0000000005070000-0x0000000005614000-memory.dmp
memory/1412-7-0x0000000004F30000-0x0000000004F6A000-memory.dmp
memory/1412-49-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-59-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-37-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-71-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-69-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-67-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-63-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-62-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-57-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-55-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-53-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-51-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-47-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-45-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-43-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-42-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-35-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-33-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-31-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-29-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-25-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-23-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-21-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-19-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-17-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-13-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-11-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-9-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-65-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-8-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-39-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-27-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-15-0x0000000004F30000-0x0000000004F65000-memory.dmp
memory/1412-800-0x0000000007AA0000-0x00000000080B8000-memory.dmp
memory/1412-801-0x00000000080E0000-0x00000000080F2000-memory.dmp
memory/1412-802-0x0000000008100000-0x000000000820A000-memory.dmp
memory/1412-803-0x0000000008220000-0x000000000825C000-memory.dmp
memory/1412-804-0x0000000002860000-0x00000000028AC000-memory.dmp
memory/1412-805-0x0000000000980000-0x0000000000A80000-memory.dmp
memory/1412-806-0x0000000002420000-0x0000000002466000-memory.dmp
memory/1412-807-0x0000000000400000-0x0000000000449000-memory.dmp