Analysis

  • max time kernel
    127s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2024 00:08

General

  • Target

    Video.mp4.scr

  • Size

    700.0MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

  • SSDEEP

    24576:Zeacs1vXtGBWz5cbwkNixCT3Mb9rmnibyQUlp:1csZsTb3ixs+mn6ypp

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2708-18-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-38-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2708-3-0x000000007490E000-0x000000007490F000-memory.dmp

    Filesize

    4KB

  • memory/2708-4-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2708-5-0x0000000005FD0000-0x0000000006124000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-6-0x0000000008160000-0x00000000082B6000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-7-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-8-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-10-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-40-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-46-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-24-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-48-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-64-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-62-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-0-0x000000007490E000-0x000000007490F000-memory.dmp

    Filesize

    4KB

  • memory/2708-20-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-42-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-12-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-14-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-16-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-22-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-1-0x00000000009F0000-0x0000000000B76000-memory.dmp

    Filesize

    1.5MB

  • memory/2708-44-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-26-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-28-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-30-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-32-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-34-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-36-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-6541-0x0000000000840000-0x0000000000876000-memory.dmp

    Filesize

    216KB

  • memory/2708-70-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-6557-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2708-68-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-66-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-60-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-58-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-56-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-54-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-52-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/2708-50-0x0000000008160000-0x00000000082AF000-memory.dmp

    Filesize

    1.3MB

  • memory/4560-6554-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4560-6556-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/4560-6555-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB

  • memory/4560-6558-0x0000000074900000-0x0000000074FEE000-memory.dmp

    Filesize

    6.9MB