Analysis
- max time kernel
111s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 16:57
General
- Target c587d8ad26ed23fc926a3a3d352721f913bc9ce63a9650a03a5b61f3fa67c7f7.exe
- Size 459KB
- Sample241113-vgnfpsyqaq
- SHA256 c587d8ad26ed23fc926a3a3d352721f913bc9ce63a9650a03a5b61f3fa67c7f7
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 35 IoCs
- Redline family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c587d8ad26ed23fc926a3a3d352721f913bc9ce63a9650a03a5b61f3fa67c7f7.exe"C:\Users\Admin\AppData\Local\Temp\c587d8ad26ed23fc926a3a3d352721f913bc9ce63a9650a03a5b61f3fa67c7f7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4376-1-0x0000000000870000-0x0000000000970000-memory.dmp
memory/4376-2-0x0000000002560000-0x00000000025A6000-memory.dmp
memory/4376-3-0x0000000000400000-0x0000000000449000-memory.dmp
memory/4376-4-0x0000000000400000-0x0000000000817000-memory.dmp
memory/4376-5-0x0000000002940000-0x000000000297C000-memory.dmp
memory/4376-6-0x0000000005170000-0x0000000005714000-memory.dmp
memory/4376-7-0x0000000002B20000-0x0000000002B5A000-memory.dmp
memory/4376-15-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-19-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-17-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-69-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-57-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-45-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-13-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-11-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-9-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-8-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-71-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-67-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-65-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-63-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-61-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-59-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-55-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-53-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-51-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-49-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-47-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-43-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-41-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-39-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-37-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-36-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-33-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-31-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-29-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-27-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-25-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-23-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-21-0x0000000002B20000-0x0000000002B55000-memory.dmp
memory/4376-800-0x0000000007AA0000-0x00000000080B8000-memory.dmp
memory/4376-801-0x00000000080E0000-0x00000000080F2000-memory.dmp
memory/4376-802-0x0000000008100000-0x000000000820A000-memory.dmp
memory/4376-803-0x0000000008220000-0x000000000825C000-memory.dmp
memory/4376-804-0x00000000026E0000-0x000000000272C000-memory.dmp
memory/4376-805-0x0000000000870000-0x0000000000970000-memory.dmp
memory/4376-806-0x0000000002560000-0x00000000025A6000-memory.dmp
memory/4376-807-0x0000000000400000-0x0000000000449000-memory.dmp