Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 03:35

General

  • Target

    84c63ed4db3cd6f64c9f38a471e134942a66bb1437cfdbfd92350ea01db40c01.exe

  • Size

    359KB

  • MD5

    4323f3c09367510b9e69944869032546

  • SHA1

    7f545756738103645d7b18dedac2851402755449

  • SHA256

    84c63ed4db3cd6f64c9f38a471e134942a66bb1437cfdbfd92350ea01db40c01

  • SHA512

    c2c0b18c9b419e6e460ff461c36a68a03b07698ab8dff153f9e14bbac881096e6f8f0abd14279a84581d8358e65f2d61077f152a1c63454647a12beaa5b66dd8

  • SSDEEP

    6144:hOiAcfq2KWRrd67NY1Tjp005CeC0v6IYPDWJM:h1Ad2jv/LC6U

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\84c63ed4db3cd6f64c9f38a471e134942a66bb1437cfdbfd92350ea01db40c01.exe
    "C:\Users\Admin\AppData\Local\Temp\84c63ed4db3cd6f64c9f38a471e134942a66bb1437cfdbfd92350ea01db40c01.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

    Filesize

    1024KB

  • memory/1740-2-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/1740-3-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1740-4-0x0000000002E10000-0x0000000002E4C000-memory.dmp

    Filesize

    240KB

  • memory/1740-5-0x00000000047E0000-0x000000000481A000-memory.dmp

    Filesize

    232KB

  • memory/1740-6-0x0000000000400000-0x0000000002BB3000-memory.dmp

    Filesize

    39.7MB

  • memory/1740-7-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-12-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-18-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-24-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-32-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-38-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-44-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-50-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-56-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-62-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-60-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-58-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-54-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-52-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-48-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-46-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-68-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-42-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-40-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-36-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-34-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-30-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-28-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-66-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-70-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-64-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-26-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-22-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-20-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-16-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-14-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-10-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-8-0x00000000047E0000-0x0000000004815000-memory.dmp

    Filesize

    212KB

  • memory/1740-799-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

    Filesize

    1024KB

  • memory/1740-800-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/1740-801-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB