Analysis
- max time kernel
130s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20250207-en - resource tags
- submitted
07/02/2025, 18:29
General
- Target Redline-Botnet-_ed--drcrypter.ru-/Redline Botnet Cracked [drcrypter.ru]/Panel/RedLine_20_2/FAQ(RUS).docx
- Size 51KB
- Sample250207-w4zb6askft
- SHA256 e3f9590d0a28e8f17d40f9a5a5489a963c6d5e722a324adf0d1d666ea424c89f
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Redline-Botnet-_ed--drcrypter.ru-\Redline Botnet Cracked [drcrypter.ru]\Panel\RedLine_20_2\FAQ(RUS).docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEUyODI4NDItMjkwMS00MEQ2LUIzMEMtQTM5QjZFQUU3RTdGfSIgdXNlcmlkPSJ7MUY2ODNCNDYtNEYyMi00QkI2LUE5QzUtRTJCMjdGMzJENkQ5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NUFBNUYyOTEtNkNGOS00NjYxLThFNzUtMkJCQzM1RjIzODRCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDc1MDQ0MjE2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
memory/2328-15-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-16-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-5-0x00007FFAA7310000-0x00007FFAA7320000-memory.dmp
memory/2328-6-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-8-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-7-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-11-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-10-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-12-0x00007FFAA4AF0000-0x00007FFAA4B00000-memory.dmp
memory/2328-13-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-9-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-1-0x00007FFAE732D000-0x00007FFAE732E000-memory.dmp
memory/2328-17-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-4-0x00007FFAA7310000-0x00007FFAA7320000-memory.dmp
memory/2328-14-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-20-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-21-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-19-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-18-0x00007FFAA4AF0000-0x00007FFAA4B00000-memory.dmp
memory/2328-2-0x00007FFAA7310000-0x00007FFAA7320000-memory.dmp
memory/2328-40-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-41-0x00007FFAE732D000-0x00007FFAE732E000-memory.dmp
memory/2328-42-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-43-0x00007FFAE7290000-0x00007FFAE7485000-memory.dmp
memory/2328-3-0x00007FFAA7310000-0x00007FFAA7320000-memory.dmp
memory/2328-0-0x00007FFAA7310000-0x00007FFAA7320000-memory.dmp