Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 10:40
General
-
Target
26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ffN.exe
-
Size
419KB
-
MD5
7a114faa1e2932c8cf6b963472abe050
-
SHA1
6f4cd6776dd8c0338a32fbe2f7c4fcd840972253
-
SHA256
26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ff
-
SHA512
484578973f4ee5394cfe7c1162ee1c0a38178f52331a58b729310a975f659206ce2211b4bbee415c3680fb90179738a9cba33c73319d7d0cf23b069d525a7cd9
-
SSDEEP
12288:3Mr9y90lSBK5eAWyl///vdZOr3PtSpycV7eka4BPllo3Zx5t:mydk5LWS//twPEEe9aCPDwZxf
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ffN.exe"C:\Users\Admin\AppData\Local\Temp\26583f6be79bec8a5732749d492f27045a4f2c3a0eb6613eb2bb737d835ae3ffN.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nLX17rQ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nLX17rQ.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
265KB
MD522fa9dc8d6bb6629c530256635becb49
SHA15041d1a1d4b8c6e442ca2d5a089c1ba146f9ed21
SHA256bb9b0f0b2564e1817399025d209a51878f070a9c0370d341398cf1c4caea59c8
SHA512b99fd8e8aff01cb53668189cf751ae020d8e004278d56f4ee8db06a2f1776a4ad5015fc848cdc3de90d3bbeb8ba45b237ee426662f6a296a2cf3d976be41b549
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB