Malicious
Classifications
Downloader Spyware Exploit Injector
Threat Names
RedLine RedLine.A
Dynamic Analysis Report
Created on 2024-06-24T16:59:00+00:00
2d1b096a33d1b673fd06db9f3e861761.rtf
RTF Document
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "5 minutes, 10 seconds" to "20 seconds" to reveal dormant functionality.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
File Name | Category | Type | Verdict | Actions |
---|
C:\Users\RDhJ0CNFevzX\Desktop\2d1b096a33d1b673fd06db9f3e861761.rtf | Sample File | RTF |
Malicious
|
...
|
»
Office Information
»
Document Content Snippet
»
44345958please click Enable editing from the yellow bar above.The independent auditors’ opinion says the financial statements are fairly stated in accordance with the basis of accounting used by your organization. So why are the auditors giving you that other letter In an audit of financial statements, professional standards require that auditors obtain an understanding of internal controls to the extent necessary to plan the audit. Auditors use this understanding of internal controls to assess the risk of material misstatement of the financial statements and to design appropriate audit procedures to minimize that risk.The definition of good internal controls is that they allow errors and other misstatements to be prevented or detected and corrected by (the nonprofit’s) employees in the normal course of performing their duties. If the auditors detect an unexpected material misstatement during your audit, it could indicate that your internal controls are not functioning properly. Conver |
C:\Users\RDhJ0CNFevzX\AppData\Roaming\notorious53209.exe | Downloaded File | Binary |
Malicious
|
...
|
»
File Reputation Information
»
Verdict |
Malicious
|
PE Information
»
Image Base | 0x00400000 |
Entry Point | 0x0051F090 |
Size Of Code | 0x00057000 |
Size Of Initialized Data | 0x00047000 |
Size Of Uninitialized Data | 0x000C8000 |
File Type | IMAGE_FILE_EXECUTABLE_IMAGE |
Subsystem | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Machine Type | IMAGE_FILE_MACHINE_I386 |
Compile Timestamp | 2024-06-24 09:38 (UTC+2) |
Sections (3)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
UPX0 | 0x00401000 | 0x000C8000 | 0x00000000 | 0x00000400 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
UPX1 | 0x004C9000 | 0x00057000 | 0x00056400 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.94 |
.rsrc | 0x00520000 | 0x00047000 | 0x00046C00 | 0x00056800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.42 |
Imports (18)
»
KERNEL32.DLL (6)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LoadLibraryA | - | 0x005668C0 | 0x001668C0 | 0x0009D0C0 | 0x00000000 |
GetProcAddress | - | 0x005668C4 | 0x001668C4 | 0x0009D0C4 | 0x00000000 |
VirtualProtect | - | 0x005668C8 | 0x001668C8 | 0x0009D0C8 | 0x00000000 |
VirtualAlloc | - | 0x005668CC | 0x001668CC | 0x0009D0CC | 0x00000000 |
VirtualFree | - | 0x005668D0 | 0x001668D0 | 0x0009D0D0 | 0x00000000 |
ExitProcess | - | 0x005668D4 | 0x001668D4 | 0x0009D0D4 | 0x00000000 |
ADVAPI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetAce | - | 0x005668DC | 0x001668DC | 0x0009D0DC | 0x00000000 |
COMCTL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ImageList_Remove | - | 0x005668E4 | 0x001668E4 | 0x0009D0E4 | 0x00000000 |
COMDLG32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetOpenFileNameW | - | 0x005668EC | 0x001668EC | 0x0009D0EC | 0x00000000 |
GDI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LineTo | - | 0x005668F4 | 0x001668F4 | 0x0009D0F4 | 0x00000000 |
IPHLPAPI.DLL (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
IcmpSendEcho | - | 0x005668FC | 0x001668FC | 0x0009D0FC | 0x00000000 |
MPR.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WNetUseConnectionW | - | 0x00566904 | 0x00166904 | 0x0009D104 | 0x00000000 |
ole32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CoGetObject | - | 0x0056690C | 0x0016690C | 0x0009D10C | 0x00000000 |
OLEAUT32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VariantInit | 0x00000008 | 0x00566914 | 0x00166914 | 0x0009D114 | - |
PSAPI.DLL (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetProcessMemoryInfo | - | 0x0056691C | 0x0016691C | 0x0009D11C | 0x00000000 |
SHELL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
DragFinish | - | 0x00566924 | 0x00166924 | 0x0009D124 | 0x00000000 |
USER32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetDC | - | 0x0056692C | 0x0016692C | 0x0009D12C | 0x00000000 |
USERENV.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LoadUserProfileW | - | 0x00566934 | 0x00166934 | 0x0009D134 | 0x00000000 |
UxTheme.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
IsThemeActive | - | 0x0056693C | 0x0016693C | 0x0009D13C | 0x00000000 |
VERSION.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VerQueryValueW | - | 0x00566944 | 0x00166944 | 0x0009D144 | 0x00000000 |
WININET.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
FtpOpenFileW | - | 0x0056694C | 0x0016694C | 0x0009D14C | 0x00000000 |
WINMM.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
timeGetTime | - | 0x00566954 | 0x00166954 | 0x0009D154 | 0x00000000 |
WSOCK32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
connect | 0x00000004 | 0x0056695C | 0x0016695C | 0x0009D15C | - |
Memory Dumps (32)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | First Execution | 32-bit | 0x012CF090 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011D7E93 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011DD812 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011E4D6B |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011D938B |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011CFF4C |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011C60E7 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011C9090 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011B2649 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011B5A64 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011E0738 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x01219393 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011B69CA |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011EE45A |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x0121768B |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011C0A8D |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011BA000 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011F220E |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x0121D000 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011DE000 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011C9090 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011BE580 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x0122474D |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011C2123 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011B4531 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011BEB4B |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x011BB381 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x01231917 |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Content Changed | 32-bit | 0x012164A2 |
...
|
||
buffer | 4 | 0x01140000 | 0x01143FFF | First Execution | 32-bit | 0x011423B0 |
...
|
||
buffer | 4 | 0x01150000 | 0x01167FFF | Dump Rule: RedLineConfig | 32-bit | - |
...
|
||
notorious53209.exe | 4 | 0x011B0000 | 0x01316FFF | Process Termination | 32-bit | - |
...
|
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp374C.tmp | Dropped File | ZIP |
Clean
|
...
|
»
C:\Users\RDHJ0C~1\AppData\Local\Temp\Keily | Dropped File | Stream |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp377D.tmp | Dropped File | ZIP |
Clean
|
...
|
»
C:\Users\RDHJ0C~1\AppData\Local\Temp\aut420D.tmp | Dropped File | Stream |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp379E.tmp | Dropped File | ZIP |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp36DD.tmp | Dropped File | Unknown |
Clean
|
...
|
»
C:\Users\RDHJ0C~1\AppData\Local\Temp\lophophorine | Dropped File | Text |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp376C.tmp | Dropped File | ZIP |
Clean
|
...
|
»
C:\Users\RDHJ0C~1\AppData\Local\Temp\aut46A2.tmp | Dropped File | Stream |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp378D.tmp | Dropped File | ZIP |
Clean
|
...
|
»
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp372C.tmp | Dropped File | ZIP |
Clean
|
...
|
»
654846ebd35db51236e44c663577686f3585d9cb4b31bcc9b35ebdeaaec03729 | Downloaded File | Text |
Clean
|
...
|
»
99c9ab8e89795240cf9be0ce0461a384a88a4923c9e539a904995eb52ee361ae | Downloaded File | Text |
Clean
|
...
|
»
54dec80fc8344b4123d4fe9981b1338e947822e758b62eda47b8ec39a582fbfb | Downloaded File | Text |
Clean
|
...
|
»
43580270910ee9931690af4be61798afb0081c5d3e8026220d6054284a435902 | Downloaded File | Unknown |
Clean
|
...
|
»
a01f6550acea4ad2c0c8332472a0e8a63f43c139af065986e91f8984d3ab6a41 | Downloaded File | Text |
Clean
|
...
|
»
86df651850a7cf084bff38e62aca1a54d165735533e3b182a0224e3a80f5c9c9 | Downloaded File | Text |
Clean
|
...
|
»
359a09d8bba39991c5b282cf52279faf23590694be06e3910dadf8dd2d0f20bc | Downloaded File | Text |
Clean
|
...
|
»
c7effe833dabd5a007460d8fcd17f5b36284c933be0f9d40a8a65fb68d102dcd | Downloaded File | Text |
Clean
|
...
|
»
59fb57baf1ed70984221ca94cd509b46a1242a99092ec0c05585c2b58c74ccf5 | Downloaded File | Text |
Clean
|
...
|
»
c:\users\rdhj0cnfevzx\appdata\local\microsoft\windows\inetcache\counters.dat | Modified File | Stream |
Clean
|
...
|
»
b5fabd4fcbcdda3d96752c9703daca8118bcc6392838d464cb1f510c858d020d | Extracted File | Image |
Clean
|
...
|
»