Overview
overview
10Static
static
Kirame.Bui...er.exe
windows10-2004-x64
10Kirame.Hos...st.exe
windows10-2004-x64
7Kirame.Loa...er.exe
windows10-2004-x64
8Panel/RedL...el.exe
windows10-2004-x64
10Panel/RedL...me.exe
windows10-2004-x64
8Panel/RedL...48.exe
windows10-2004-x64
8Panel/RedL...ar.exe
windows10-2004-x64
1Analysis
-
max time kernel
34s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 22:01
Static task
static1
Behavioral task
behavioral1
Sample
Kirame.Builder/Kirame.Builder.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
Kirame.Host/Kirame.Host.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
Kirame.Loader/Kirame.Loader.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
Panel/RedLine20_22/Panel/Panel.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Panel/RedLine20_22/Tools/Chrome.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral6
Sample
Panel/RedLine20_22/Tools/NetFramework48.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Panel/RedLine20_22/Tools/WinRar.exe
Resource
win10v2004-20220812-en
General
-
Target
Panel/RedLine20_22/Panel/Panel.exe
-
Size
9.3MB
-
MD5
f4e19b67ef27af1434151a512860574e
-
SHA1
56304fc2729974124341e697f3b21c84a8dd242a
-
SHA256
c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
-
SHA512
a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
SSDEEP
196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/c1sxXoP3p:mJQaPHrQqXs140qMhu8369sV+HLz9SKI
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral4/memory/4888-146-0x000000001DAB0000-0x000000001DBF2000-memory.dmp family_redline behavioral4/memory/4888-152-0x000000001DAB0000-0x000000001DBF2000-memory.dmp family_redline behavioral4/memory/4888-160-0x000000001DE80000-0x000000001DFC2000-memory.dmp family_redline behavioral4/memory/4888-196-0x000000001DE80000-0x000000001DFC2000-memory.dmp family_redline behavioral4/memory/4888-197-0x000000001DE80000-0x000000001DFC2000-memory.dmp family_redline -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1428 4888 WerFault.exe Panel.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
Panel.exepid process 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe 4888 Panel.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Panel.exedescription pid process Token: SeDebugPrivilege 4888 Panel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4888 -s 21362⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4888 -ip 48881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4888-132-0x00007FFBEAE00000-0x00007FFBEB8C1000-memory.dmpFilesize
10.8MB
-
memory/4888-136-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/4888-134-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/4888-138-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/4888-133-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/4888-140-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/4888-144-0x000000001DAB0000-0x000000001DBF2000-memory.dmpFilesize
1.3MB
-
memory/4888-146-0x000000001DAB0000-0x000000001DBF2000-memory.dmpFilesize
1.3MB
-
memory/4888-153-0x000000001ADB0000-0x000000001AF50000-memory.dmpFilesize
1.6MB
-
memory/4888-151-0x00007FFBEAE00000-0x00007FFBEB8C1000-memory.dmpFilesize
10.8MB
-
memory/4888-152-0x000000001DAB0000-0x000000001DBF2000-memory.dmpFilesize
1.3MB
-
memory/4888-160-0x000000001DE80000-0x000000001DFC2000-memory.dmpFilesize
1.3MB
-
memory/4888-176-0x000000001DBB0000-0x000000001DBBA000-memory.dmpFilesize
40KB
-
memory/4888-180-0x000000001DBB0000-0x000000001DBBA000-memory.dmpFilesize
40KB
-
memory/4888-178-0x000000001DBB0000-0x000000001DBBA000-memory.dmpFilesize
40KB
-
memory/4888-182-0x000000001DBB0000-0x000000001DBBA000-memory.dmpFilesize
40KB
-
memory/4888-189-0x000000001DBC0000-0x000000001DBCA000-memory.dmpFilesize
40KB
-
memory/4888-190-0x00007FFBEC3C0000-0x00007FFBEC50E000-memory.dmpFilesize
1.3MB
-
memory/4888-192-0x000000001DBC0000-0x000000001DBCA000-memory.dmpFilesize
40KB
-
memory/4888-193-0x000000001DBC0000-0x000000001DBCA000-memory.dmpFilesize
40KB
-
memory/4888-194-0x000000001DBC0000-0x000000001DBCA000-memory.dmpFilesize
40KB
-
memory/4888-196-0x000000001DE80000-0x000000001DFC2000-memory.dmpFilesize
1.3MB
-
memory/4888-197-0x000000001DE80000-0x000000001DFC2000-memory.dmpFilesize
1.3MB
-
memory/4888-221-0x000000001ADAC000-0x000000001ADAF000-memory.dmpFilesize
12KB
-
memory/4888-423-0x0000000020920000-0x0000000020923000-memory.dmpFilesize
12KB
-
memory/4888-510-0x00007FFBEAE00000-0x00007FFBEB8C1000-memory.dmpFilesize
10.8MB
-
memory/4888-719-0x0000000020927000-0x000000002092A000-memory.dmpFilesize
12KB
-
memory/4888-923-0x000000002092A000-0x000000002092D000-memory.dmpFilesize
12KB
-
memory/4888-1096-0x000000001ADAC000-0x000000001ADAF000-memory.dmpFilesize
12KB
-
memory/4888-1206-0x000000002092D000-0x0000000020930000-memory.dmpFilesize
12KB
-
memory/4888-1316-0x0000000020920000-0x0000000020923000-memory.dmpFilesize
12KB
-
memory/4888-1472-0x0000000020927000-0x000000002092A000-memory.dmpFilesize
12KB
-
memory/4888-1475-0x000000002092A000-0x000000002092D000-memory.dmpFilesize
12KB
-
memory/4888-1477-0x000000001ADAC000-0x000000001ADAF000-memory.dmpFilesize
12KB
-
memory/4888-1476-0x00007FFBEAE00000-0x00007FFBEB8C1000-memory.dmpFilesize
10.8MB