Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 06:32
General
- Target RedLineOps.exe
- Size 49.7MB
- Sample260928-has2dsxt2n
- SHA256 3b07aa5b847f88e96e977928439d6e42da039b29269e4f442c8aa11c09618587
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedLineOps.exe"C:\Users\Admin\AppData\Local\Temp\RedLineOps.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\RedLineOps\RedLineOps.exe"C:\Users\Admin\AppData\Local\RedLineOps\RedLineOps.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RedLineOps.exe
memory/1988-188-0x0000029F1B490000-0x0000029F1B4D0000-memory.dmp
memory/1988-184-0x0000029F1BA50000-0x0000029F1BC00000-memory.dmp
memory/1988-181-0x0000029F1B6D0000-0x0000029F1B8A0000-memory.dmp
memory/1988-171-0x0000029F1A910000-0x0000029F1AA00000-memory.dmp
memory/1988-167-0x0000029F1ADC0000-0x0000029F1B140000-memory.dmp
memory/4720-22-0x000001BAA86C0000-0x000001BAA8730000-memory.dmp
memory/4720-70-0x000001BA956F0000-0x000001BA95700000-memory.dmp
memory/4720-46-0x000001BAAAFA0000-0x000001BAAAFC0000-memory.dmp
memory/4720-38-0x000001BA94390000-0x000001BA94470000-memory.dmp
memory/4720-34-0x000001BAAB030000-0x000001BAAB080000-memory.dmp
memory/4720-30-0x000001BAAAF80000-0x000001BAAAFA0000-memory.dmp
memory/4720-2-0x000001BAA9690000-0x000001BAAA5E0000-memory.dmp
memory/4720-14-0x000001BAAA960000-0x000001BAAACE0000-memory.dmp
memory/4720-10-0x000001BAA8070000-0x000001BAA8090000-memory.dmp
memory/4720-66-0x000001BA94790000-0x000001BA947B0000-memory.dmp
memory/4720-62-0x000001BA956A0000-0x000001BA956D0000-memory.dmp
memory/4720-50-0x000001BA946F0000-0x000001BA94710000-memory.dmp
memory/4720-77-0x000001BA96C90000-0x000001BA96D50000-memory.dmp
memory/4720-78-0x000001BA96B70000-0x000001BA96B90000-memory.dmp
memory/4720-54-0x000001BA946C0000-0x000001BA946D0000-memory.dmp
memory/4720-85-0x000001BA97710000-0x000001BA977C0000-memory.dmp
memory/4720-58-0x000001BA951C0000-0x000001BA95200000-memory.dmp
memory/4720-18-0x000001BAA84F0000-0x000001BAA86C0000-memory.dmp
memory/4720-42-0x000001BAAB080000-0x000001BAAB0D0000-memory.dmp
memory/4720-26-0x000001BAA80C0000-0x000001BAA80E0000-memory.dmp
memory/4720-6-0x000001BA93670000-0x000001BA94390000-memory.dmp