Overview

overview

10

Static

static

10

1/0178b79b...bd.exe

windows7-x64

10

1/0178b79b...bd.exe

windows10-2004-x64

10

1/0280cde4...60.exe

windows7-x64

10

1/0280cde4...60.exe

windows10-2004-x64

10

1/08b76206...65.exe

windows7-x64

10

1/08b76206...65.exe

windows10-2004-x64

10

1/0e4fc438...91.exe

windows7-x64

3

1/0e4fc438...91.exe

windows10-2004-x64

10

1/0fb86a8b...05.exe

windows7-x64

10

1/0fb86a8b...05.exe

windows10-2004-x64

10

1/25898c73...8f.exe

windows7-x64

10

1/25898c73...8f.exe

windows10-2004-x64

3

1/2c2e9491...3c.exe

windows7-x64

3

1/2c2e9491...3c.exe

windows10-2004-x64

10

1/2ef0f582...2e.exe

windows7-x64

3

1/2ef0f582...2e.exe

windows10-2004-x64

10

1/39884fc0...82.exe

windows7-x64

10

1/39884fc0...82.exe

windows10-2004-x64

10

1/3a72ecec...8a.exe

windows7-x64

10

1/3a72ecec...8a.exe

windows10-2004-x64

10

1/3bfcb4f7...71.exe

windows7-x64

10

1/3bfcb4f7...71.exe

windows10-2004-x64

10

1/4103411f...f5.exe

windows7-x64

10

1/4103411f...f5.exe

windows10-2004-x64

10

1/4e0fdb84...95.exe

windows7-x64

3

1/4e0fdb84...95.exe

windows10-2004-x64

7

1/5297372f...33.exe

windows7-x64

5

1/5297372f...33.exe

windows10-2004-x64

5

1/68292f38...e4.exe

windows7-x64

3

1/68292f38...e4.exe

windows10-2004-x64

10

1/6da4696b...e5.exe

windows7-x64

7

1/6da4696b...e5.exe

windows10-2004-x64

7

Resubmissions

11/12/2024, 15:32

241211-sy44nssrdm10

09/08/2024, 21:57

240809-1t1vfs1cpm10

06/08/2024, 13:03

240806-qas1dszdqm

06/08/2024, 13:01

240806-p9f97szdlm10

06/08/2024, 12:52

240806-p3672stdkg10

06/08/2024, 12:29

240806-ppa8fsygqr10

06/08/2024, 12:29

240806-pn9pmaygqq

06/08/2024, 12:26

240806-pmc92ashlh10

Analysis

  • max time kernel
    145s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 15:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1/4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
  • Size 109KB
  • Sample241211-sy44nssrdm
  • SHA256 4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
redline6951125327discoveryinfostealer

Malware Config

Extracted

Family

  • redline

Botnet

  • 6951125327

C2

  • https://t.me/+7Lir0e4Gw381MDhi

  • https://steamcommunity.com/profiles/76561199038841443

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe
    "C:\Users\Admin\AppData\Local\Temp\1\4103411f7bb66a033f9f5ce35839ba08b2a27d169e188a911185790f3b78bbf5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2676

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/2676-0-0x00007FFD50683000-0x00007FFD50685000-memory.dmp
        Download

        memory/2676-1-0x000002108AB20000-0x000002108AB42000-memory.dmp
        Download

        memory/2676-2-0x00000210A5180000-0x00000210A528A000-memory.dmp
        Download

        memory/2676-3-0x000002108C700000-0x000002108C712000-memory.dmp
        Download

        memory/2676-4-0x00007FFD50680000-0x00007FFD51141000-memory.dmp
        Download

        memory/2676-5-0x00000210A50B0000-0x00000210A50EC000-memory.dmp
        Download

        memory/2676-6-0x00007FFD50683000-0x00007FFD50685000-memory.dmp
        Download

        memory/2676-7-0x00007FFD50680000-0x00007FFD51141000-memory.dmp
        Download