Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 06:32
General
- Target RedLineOps.exe
- Size 49.7MB
- Sample260928-has2dsxt2n
- SHA256 3b07aa5b847f88e96e977928439d6e42da039b29269e4f442c8aa11c09618587
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedLineOps.exe"C:\Users\Admin\AppData\Local\Temp\RedLineOps.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RedLineOps\RedLineOps.exe"C:\Users\Admin\AppData\Local\RedLineOps\RedLineOps.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RedLineOps.exe
memory/2676-183-0x000001E065B10000-0x000001E065CE0000-memory.dmp
memory/2676-187-0x000001E065E90000-0x000001E066040000-memory.dmp
memory/2676-191-0x000001E0658D0000-0x000001E065910000-memory.dmp
memory/2676-170-0x000001E065200000-0x000001E065580000-memory.dmp
memory/2676-174-0x000001E064D50000-0x000001E064E40000-memory.dmp
memory/4744-34-0x000001EEEFED0000-0x000001EEEFF20000-memory.dmp
memory/4744-70-0x000001F6F4DA0000-0x000001F6F4DB0000-memory.dmp
memory/4744-58-0x000001F6F45F0000-0x000001F6F4630000-memory.dmp
memory/4744-54-0x000001F6F45D0000-0x000001F6F45E0000-memory.dmp
memory/4744-50-0x000001EEEFF20000-0x000001EEEFF40000-memory.dmp
memory/4744-38-0x000001F6F44A0000-0x000001F6F4580000-memory.dmp
memory/4744-2-0x000001EEF0E90000-0x000001EEF1DE0000-memory.dmp
memory/4744-30-0x000001EEEF7F0000-0x000001EEEF810000-memory.dmp
memory/4744-26-0x000001EEEF680000-0x000001EEEF6A0000-memory.dmp
memory/4744-66-0x000001F6F4D00000-0x000001F6F4D20000-memory.dmp
memory/4744-62-0x000001F6F4D50000-0x000001F6F4D80000-memory.dmp
memory/4744-42-0x000001F6F4580000-0x000001F6F45D0000-memory.dmp
memory/4744-74-0x000001F6F6180000-0x000001F6F6240000-memory.dmp
memory/4744-78-0x000001F6F4E20000-0x000001F6F4E40000-memory.dmp
memory/4744-46-0x000001EEEF820000-0x000001EEEF840000-memory.dmp
memory/4744-89-0x000001F6F6BC0000-0x000001F6F6C70000-memory.dmp
memory/4744-14-0x000001EEF2160000-0x000001EEF24E0000-memory.dmp
memory/4744-22-0x000001EEEF760000-0x000001EEEF7D0000-memory.dmp
memory/4744-18-0x000001EEF24E0000-0x000001EEF26B0000-memory.dmp
memory/4744-10-0x000001EEEF640000-0x000001EEEF660000-memory.dmp
memory/4744-7-0x000001F6F3690000-0x000001F6F43B0000-memory.dmp