Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 04:01
General
-
Target
12d17e5a083061a99740620bfa83489f1b0cd0108034bc7a35718e5afedaa6d3N.exe
-
Size
535KB
-
MD5
23ac4b97b4bb73f3d639ad90b1d99650
-
SHA1
2720468801de16b175a5e0a0fc44f183400f973b
-
SHA256
12d17e5a083061a99740620bfa83489f1b0cd0108034bc7a35718e5afedaa6d3
-
SHA512
9924a2909a4f2fbde8755d1ccd2e9ec2475265b99415249cfa693191cf167e4216903ed95ee4c8a12bba80140255e00110bff3b5011cb428382649f63a1985ae
-
SSDEEP
12288:8MrNy90CRrVYZRgJGODKvTkZPipHmusJz9aQoCD:JydRhYZaKbkZPi4TDoG
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12d17e5a083061a99740620bfa83489f1b0cd0108034bc7a35718e5afedaa6d3N.exe"C:\Users\Admin\AppData\Local\Temp\12d17e5a083061a99740620bfa83489f1b0cd0108034bc7a35718e5afedaa6d3N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vHr33.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vHr33.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dHY17.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dHY17.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD5fe4ff49182dfee505f91aede22da1439
SHA1f00165ac79f2361dd9e7f57fabf1f38cea56f972
SHA256f29f2ffd8de760b7ce2dc7aa1841c2d124c7ddee41a97744cc12201eeb6f29c1
SHA512802a6bc6cf1133fda41504a7755422c21885451937a615d0dee55fcf6cd08cb9953a8d0fef2bd54cbc4bee0450757bf376fab2bb1ff7eaecc88cb872ad870c0a
-
Filesize
292KB
MD5fccf6562a883fd1b5018c5ab4a8a4e7b
SHA14c9364937299754131ee62bfabf9ee4aab0a37ea
SHA2561a3dba1ef67282503c03eda8b429716c96670a3a20e1770b68ff0b73a78049e8
SHA5127842b54e1a1ea27e0f033dbbdf10ba93ff4cb04b06ff4539b15c99047baafcb92bc91a414843918f2b6ac386d27203ef24b2f694abce8d14acb99889c130b1a5
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB