Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-12-2024 05:24

General

  • Target

    Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Panel.exe

  • Size

    12.1MB

  • MD5

    85afedf22ca7d0561be4443e854459a7

  • SHA1

    1fec08de68672a302f0df40ff30b22cee4d18057

  • SHA256

    130a2379f8f07cec2cd9935bdf67bfcfbb977327f89f017dc16f19efc871d864

  • SHA512

    e5229c4e67bc7d4ef8b53c94cfd017833797ecb52a93d71e9770ae50aaaa8e3e6c9b6433389f85255c2fe92bf94bdf1f6d1c49a01ac0809d7c8ccdb8c07dce03

  • SSDEEP

    393216:+A+bVvdvbtsjjBbns3JX08gNghF5tAVsQsaBMvBVvrsV4ojavjdTbvosw+z6VVq1:+A+bVvdvbtsjjBbns3JX08gNghF5tAV8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redline Stealer v30.2 Cracked By @Drcrypt0r\Panel\Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Redline Stealer v30.2 Cracked By @Drcrypt0r\Panel\Panel.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Users\Admin\AppData\Local\Temp\Redline Stealer v30.2 Cracked By @Drcrypt0r\Panel\Panel.exe
      "C:\Users\Admin\AppData\Local\Temp\Redline Stealer v30.2 Cracked By @Drcrypt0r\Panel\Panel.exe" "--monitor"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Redline Stealer v30.2 Cracked By @Drcrypt0r\Panel\stats.json

    Filesize

    174B

    MD5

    0f91aea181cd167baad6ef0f2f07176d

    SHA1

    924f29e47a17e4933a4d8db2627344657acbca20

    SHA256

    60f69cf6704a36cfdb8ca2b1304db90b8dc60ff1364ff225c9c97c928b4577cf

    SHA512

    025ecaaeb9972978792c86a5c5f0d4aa53dfcaf30ea867808cd398ed7ab1acf53e179393aeab0424bd23115fc267723d4fcb70107347fbb8ad3f1ff8e9c3d3dd

  • memory/4132-0-0x00007FFC95973000-0x00007FFC95975000-memory.dmp

    Filesize

    8KB

  • memory/4132-1-0x000001456CA40000-0x000001456D654000-memory.dmp

    Filesize

    12.1MB

  • memory/4132-2-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4132-25-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4132-24-0x00007FFC95973000-0x00007FFC95975000-memory.dmp

    Filesize

    8KB

  • memory/4804-5-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4804-15-0x0000027A756C0000-0x0000027A756D0000-memory.dmp

    Filesize

    64KB

  • memory/4804-8-0x0000027A71A30000-0x0000027A71AE0000-memory.dmp

    Filesize

    704KB

  • memory/4804-9-0x0000027A71510000-0x0000027A7154A000-memory.dmp

    Filesize

    232KB

  • memory/4804-10-0x0000027A71550000-0x0000027A71572000-memory.dmp

    Filesize

    136KB

  • memory/4804-11-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4804-12-0x0000027A72C30000-0x0000027A72CE8000-memory.dmp

    Filesize

    736KB

  • memory/4804-13-0x0000027A75620000-0x0000027A7566A000-memory.dmp

    Filesize

    296KB

  • memory/4804-14-0x0000027A755F0000-0x0000027A75608000-memory.dmp

    Filesize

    96KB

  • memory/4804-7-0x0000027A6F640000-0x0000027A6F650000-memory.dmp

    Filesize

    64KB

  • memory/4804-19-0x0000027A75690000-0x0000027A756A2000-memory.dmp

    Filesize

    72KB

  • memory/4804-20-0x0000027A75F30000-0x0000027A75F6C000-memory.dmp

    Filesize

    240KB

  • memory/4804-4-0x0000027A71710000-0x0000027A71784000-memory.dmp

    Filesize

    464KB

  • memory/4804-6-0x0000027A70DE0000-0x0000027A70DF2000-memory.dmp

    Filesize

    72KB

  • memory/4804-26-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4804-27-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4804-28-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB

  • memory/4804-3-0x00007FFC95970000-0x00007FFC96432000-memory.dmp

    Filesize

    10.8MB