Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 13:09
General
- Target RedMClean.exe
- Size 593KB
- Sample261015-qd545adh69
- SHA256 c6af52a60eb5937935eb47e513d0917cf9117a4dd648ca08fdeed429dcc1217e
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedMClean.exe"C:\Users\Admin\AppData\Local\Temp\RedMClean.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4316-0-0x00007FFA371CF000-0x00007FFA371D0000-memory.dmp
memory/4316-1-0x0000000000E50000-0x0000000000EEA000-memory.dmp
memory/4316-3-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-4-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-5-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-6-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-7-0x000000001CA30000-0x000000001CBF2000-memory.dmp
memory/4316-8-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-9-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-11-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-12-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-13-0x00000000228E0000-0x0000000022E08000-memory.dmp
memory/4316-14-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-18-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-19-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-20-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-21-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-22-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp
memory/4316-23-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp