Resubmissions
07-01-2025 01:39
250107-b213raxqbx 1006-01-2025 23:51
250106-3wa3xstmfx 1006-01-2025 23:43
250106-3qm6asvrbr 10Analysis
-
max time kernel
97s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
06-01-2025 23:43
General
-
Target
skibidibi.zip
-
Size
15.0MB
-
MD5
e3c095bad1b222b74dfab35fce9b58fc
-
SHA1
dafa30f20bfabe025c446186c3051e713559b635
-
SHA256
ddc4ee5b164774a9bcbc42636ae1b555c0e652943f89809adfe17643739c09d9
-
SHA512
509ef669bacb93d494e0df57ca3e5ec3d371815a58ed5c68d445bc2feba57588f6ad0a30efd4cc0894c1c63f4761a422897825021280d2ddbcd40428f5cecfbb
-
SSDEEP
393216:oWXzo7MYwJONnGHVWx55TbJDnJ6YrNDseN3zGASyC3FzeV8Qic1k:nDokMqWD5TdbJ6YrNrzd1ABeVqc1k
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Opens file in notepad (likely ransom note) 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\skibidibi.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Kurome.Loader\Kurome.Loader.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Kurome.Loader\Kurome.Loader.exe"1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe" "--monitor"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcfc+zqxGdUek2aJ8Sh1JLAAAAAACAAAAAAAQZgAAAAEAACAAAAC/cJFkiuwixZ0nSGn4LJfXjrhIg3ORznux/tXnR7DUGgAAAAAOgAAAAAIAACAAAABv/njLaU+of3IuYJSxj6tYQwfqbY9Sp0GDUzKmXSMFAhAAAAAQZKatboskCzGLIFJL+sm4QAAAAJl1nlFeh+ZWejyniyrxzC4zYHYCpLDbHVL30d2XlcDagiarYwO8km++1FDUizZ3mmMaBXNOIiYzBrDyOgrm7Ps=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcfc+zqxGdUek2aJ8Sh1JLAAAAAACAAAAAAAQZgAAAAEAACAAAACGJIL0ZtlGaWI1m+/aiFjynaFTdoWWBQi1rUfsa5jXVwAAAAAOgAAAAAIAACAAAADSptPBjtzzN9Vv7Qdvsu8wT/TZCXnBRmLuyOo+bqisaBAAAAD6GQ+CXcSM/2FGsm7/KjwNQAAAAHEZuCtHCHnSK3AvpKgXaGqWpMzSZBKMjo5uMZNwETWvFp874eBqXk72GyBBfWIwmJ3WgbJ1LoP1XhVOpG6RYcM="3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe" "auth" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcfc+zqxGdUek2aJ8Sh1JLAAAAAACAAAAAAAQZgAAAAEAACAAAAC/cJFkiuwixZ0nSGn4LJfXjrhIg3ORznux/tXnR7DUGgAAAAAOgAAAAAIAACAAAABv/njLaU+of3IuYJSxj6tYQwfqbY9Sp0GDUzKmXSMFAhAAAAAQZKatboskCzGLIFJL+sm4QAAAAJl1nlFeh+ZWejyniyrxzC4zYHYCpLDbHVL30d2XlcDagiarYwO8km++1FDUizZ3mmMaBXNOIiYzBrDyOgrm7Ps=" "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAcfc+zqxGdUek2aJ8Sh1JLAAAAAACAAAAAAAQZgAAAAEAACAAAACGJIL0ZtlGaWI1m+/aiFjynaFTdoWWBQi1rUfsa5jXVwAAAAAOgAAAAAIAACAAAADSptPBjtzzN9Vv7Qdvsu8wT/TZCXnBRmLuyOo+bqisaBAAAAD6GQ+CXcSM/2FGsm7/KjwNQAAAAHEZuCtHCHnSK3AvpKgXaGqWpMzSZBKMjo5uMZNwETWvFp874eBqXk72GyBBfWIwmJ3WgbJ1LoP1XhVOpG6RYcM=" "--monitor"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Redline_20_2_crack\Panel\RedLine_20_2\FAQ.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Redline_20_2_crack\ReadMe.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fa2242a848c015e90751992478acf1b0
SHA19b54d26e4c0630490ab230b9d15119d036c3398f
SHA2560b71c524f4b9a3964104689ba24c413a0811e83d1071a2bb066b66c91053f147
SHA51269d1962db48657f3c8b24e79a7846aa0e4fcfc2b27c3675915a7906913c897dff0e91bd06634615d6c5b62c4afae41827d7fa1944f84d11f8a731bab1cf7629b
-
Filesize
119KB
MD54fde0f80c408af27a8d3ddeffea12251
SHA1e834291127af150ce287443c5ea607a7ae337484
SHA2561b644cdb1c7247c07d810c0ea10bec34dc5600f3645589690a219de08cf2dedb
SHA5123693aeaa2cc276060b899f21f6f57f435b75fec5bcd7725b2dd79043b341c12ebc29bd43b287eb22a3e31fd2b50c4fa36bf020f9f3db5e2f75fe8cc747eca5f5
-
Filesize
189B
MD55a7f52d69e6fca128023469ae760c6d5
SHA19d7f75734a533615042f510934402c035ac492f7
SHA256498c7f8e872f9cef0cf04f7d290cf3804c82a007202c9b484128c94d03040fd0
SHA5124dc8ae80ae9e61d2801441b6928a85dcf9d6d73656d064ffbc0ce9ee3ad531bfb140e9f802e39da2a83af6de606b115e5ccd3da35d9078b413b1d1846cbd1b4f
-
Filesize
123KB
MD5e3d39e30e0cdb76a939905da91fe72c8
SHA1433fc7dc929380625c8a6077d3a697e22db8ed14
SHA2564bfa493b75361920e6403c3d85d91a454c16ddda89a97c425257e92b352edd74
SHA5129bb3477023193496ad20b7d11357e510ba3d02b036d6f35f57d061b1fc4d0f6cb3055ae040d78232c8a732d9241699ddcfac83cc377230109bf193736d9f92b8
-
Filesize
2.2MB
MD5a3ec05d5872f45528bbd05aeecf0a4ba
SHA168486279c63457b0579d86cd44dd65279f22d36f
SHA256d4797b2e4957c9041ba32454657f5d9a457851c6b5845a57e0e5397707e7773e
SHA512b96b582bb26cb40dbb2a0709a6c88acd87242d0607d548473e3023ffa0a6c9348922a98a4948f105ea0b8224a3930af1e698c6cee3c36ca6a83df6d20c868e8e
-
Filesize
186B
MD59070d769fd43fb9def7e9954fba4c033
SHA1de4699cdf9ad03aef060470c856f44d3faa7ea7f
SHA256cbaf2ae95b1133026c58ab6362af2f7fb2a1871d7ad58b87bd73137598228d9b
SHA512170028b66c5d2db2b8c90105b77b0b691bf9528dc9f07d4b3983d93e9e37ea1154095aaf264fb8b5e67c167239697337cc9e585e87ef35faa65a969cac1aa518
-
Filesize
19KB
MD553fc20e1e68a5619f7ff2df8e99d42c4
SHA17a8ddc81d16aaab533411810acfad1546c30dc2f
SHA256fc7ceb47aa8796614f098406452ea67cb58929ded1d4c6bd944d4d34921bba0b
SHA512c1ad4f2dfd50528d613e9fe3f55da0bbb5c8442b459d9c3c989b75014c827306f72f2eb6ecbcd92ff11546e12087c09685b12a7dc258c5ea85c15ba5cc002d8c
-
Filesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
Filesize
26KB
MD5494890d393a5a8c54771186a87b0265e
SHA1162fa5909c1c3f84d34bda5d3370a957fe58c9c8
SHA256f2a5a06359713226aeacfe239eeb8ae8606f4588d8e58a19947c3a190efbdfc7
SHA51240fbd033f288fee074fc36e899796efb30d3c582784b834fc583706f19a0b8d5a134c6d1405afe563d2676072e4eefc4e169b2087867cab77a3fa1aa1a7c9395
-
Filesize
74B
MD50ff78cb381410bd5fbb47343ead61916
SHA184c7bebff975ce1710f762787eaa5cb7059edbba
SHA256bece84f0e07927c39bd0ba14328066988142d7d5e8b2e7ca2226261576988427
SHA51281ca9be129f22b1f1da037f7ee08b7d3b62cf8e56c6bb26c4ed1970feebd9f7a4b628216786957c3a7da095e5a54a226346442830d28fcfd618ea32bf7c82389
-
Filesize
401B
MD50e9ea2262b11db9e8c1656c949da4495
SHA1f332749e10817048cea5e1584edf5e88f47024eb
SHA256ad8361226621c8261d69e1202e7f9831a00f3bb6549d77219d5deb0e8a6cbde6
SHA51200aae0c559823ff27ca8af431d24d4fe8a3f4683b0d776a80fb14a96d82030cedf6ec1ddf2efd7fc229e2c2b3ab3ac0b15326dc1912cdd07932ec7ff8f80975c
-
Filesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
824KB
-
Filesize
1.0MB
-
Filesize
160KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
144KB
-
Filesize
6.1MB
-
Filesize
7.7MB
-
Filesize
152KB
-
Filesize
6.1MB
-
Filesize
2.2MB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
20KB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
20KB
-
Filesize
40KB
-
Filesize
1.3MB
-
Filesize
20KB
-
Filesize
3.4MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
112KB
-
Filesize
1.5MB
-
Filesize
10.8MB
-
Filesize
1.6MB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
2.5MB
-
Filesize
240KB
-
Filesize
1024KB
-
Filesize
704KB
-
Filesize
232KB
-
Filesize
72KB
-
Filesize
464KB
-
Filesize
296KB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
624KB
-
Filesize
316KB
-
Filesize
1.0MB
-
Filesize
192KB
-
Filesize
136KB
-
Filesize
3.4MB
-
Filesize
96KB
-
Filesize
104KB
-
Filesize
408KB