Analysis
- max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 06:01
General
- Target file.exe
- Size 33.9MB
- Sample260714-graqpsht4x
- SHA256 7b2a28e5ecbdeb4e608026e8c548ef5f50e4aad5da5ae7bfcc5e9ee05e91e80a
Malware Config
Extracted
-
redline
-
kilo3click
-
94.154.32.144:1912
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Detects DonutLoader 1 IoCs
- RedLine payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -NonI -W Hidden -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ExclusionProcess 'powershell.exe' -ExclusionProcess 'dllhost.exe' -ExclusionProcess 'explorer.exe' 2>$null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/772-42-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-80-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-51-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-49-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-48-0x000001C956D30000-0x000001C956D3A000-memory.dmp
memory/772-46-0x000001C956D40000-0x000001C956D5E000-memory.dmp
memory/772-47-0x000001C956D60000-0x000001C956E12000-memory.dmp
memory/772-43-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-32-0x00007FFCD4BFF000-0x00007FFCD4C00000-memory.dmp
memory/772-33-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-36-0x000001C93E830000-0x000001C93E852000-memory.dmp
memory/772-37-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-38-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-39-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-40-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/772-41-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-56-0x000001DD02920000-0x000001DD02973000-memory.dmp
memory/2508-64-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-12-0x000001DD005E0000-0x000001DD00610000-memory.dmp
memory/2508-16-0x000001DD00610000-0x000001DD00660000-memory.dmp
memory/2508-20-0x000001DD00590000-0x000001DD005B0000-memory.dmp
memory/2508-24-0x000001DD028D0000-0x000001DD02920000-memory.dmp
memory/2508-28-0x000001DD024A0000-0x000001DD024C0000-memory.dmp
memory/2508-52-0x000001DD02AA0000-0x000001DD02AE0000-memory.dmp
memory/2508-0-0x000001DD01470000-0x000001DD02100000-memory.dmp
memory/2508-57-0x000001DD04890000-0x000001DD048E2000-memory.dmp
memory/2508-58-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-59-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-61-0x000001DD3B030000-0x000001DD3B042000-memory.dmp
memory/2508-63-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-62-0x000001DD3C8A0000-0x000001DD3C8DC000-memory.dmp
memory/2508-8-0x000001DD026D0000-0x000001DD028D0000-memory.dmp
memory/2508-60-0x0000021DD15E0000-0x0000021DD16EA000-memory.dmp
memory/2508-65-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-66-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-68-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-69-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-70-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-71-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-72-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-73-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-67-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-74-0x000001DD3C8E0000-0x000001DD3C930000-memory.dmp
memory/2508-75-0x0000021DD18C0000-0x0000021DD1A82000-memory.dmp
memory/2508-76-0x000001DD1FE50000-0x000001DD20378000-memory.dmp
memory/2508-77-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-79-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
memory/2508-4-0x000001DD00550000-0x000001DD00570000-memory.dmp