Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 00:08

General

  • Target

    Video.mp4.scr

  • Size

    700.0MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

  • SSDEEP

    24576:Zeacs1vXtGBWz5cbwkNixCT3Mb9rmnibyQUlp:1csZsTb3ixs+mn6ypp

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Video.mp4.scr.log

    Filesize

    1KB

    MD5

    df27a876383bd81dfbcb457a9fa9f09d

    SHA1

    1bbc4ab95c89d02ec1d217f0255205787999164e

    SHA256

    8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

    SHA512

    fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

  • memory/1104-6548-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1104-6549-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1104-6551-0x0000000005750000-0x0000000005D68000-memory.dmp

    Filesize

    6.1MB

  • memory/1104-6552-0x0000000005160000-0x0000000005172000-memory.dmp

    Filesize

    72KB

  • memory/1104-6557-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1104-6556-0x0000000005200000-0x000000000524C000-memory.dmp

    Filesize

    304KB

  • memory/1104-6555-0x00000000051C0000-0x00000000051FC000-memory.dmp

    Filesize

    240KB

  • memory/1104-6554-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1104-6553-0x0000000005290000-0x000000000539A000-memory.dmp

    Filesize

    1.0MB

  • memory/1544-55-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-41-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-7-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1544-8-0x0000000006D70000-0x0000000006EC4000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-9-0x0000000006FC0000-0x0000000007116000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-17-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-15-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-61-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-73-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-71-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-69-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-67-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-65-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-63-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-59-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-57-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-5-0x0000000005840000-0x000000000584A000-memory.dmp

    Filesize

    40KB

  • memory/1544-51-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-49-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-47-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-45-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-53-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-43-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-6-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1544-39-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-37-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-35-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-31-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-30-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-25-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-23-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-21-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-19-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-13-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-11-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-33-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-27-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-10-0x0000000006FC0000-0x000000000710F000-memory.dmp

    Filesize

    1.3MB

  • memory/1544-4-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1544-3-0x0000000005690000-0x0000000005722000-memory.dmp

    Filesize

    584KB

  • memory/1544-2-0x0000000005EE0000-0x0000000006484000-memory.dmp

    Filesize

    5.6MB

  • memory/1544-1-0x0000000000B00000-0x0000000000C86000-memory.dmp

    Filesize

    1.5MB

  • memory/1544-0-0x000000007462E000-0x000000007462F000-memory.dmp

    Filesize

    4KB

  • memory/1544-6544-0x0000000007700000-0x0000000007736000-memory.dmp

    Filesize

    216KB

  • memory/1544-6550-0x0000000074620000-0x0000000074DD0000-memory.dmp

    Filesize

    7.7MB