redline | bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe
Size

919KB
MD5

1d056a903844e38709bcc3ff46d48571
SHA1

e901806e95a996a32aeb1c9c9a2dab09fbdc1c7a
SHA256

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe
SHA512

59d799998c4ac7c398c2831e02a405b3e3ff3ec70fcbaf18848ff924e4fac70b321b6e1436f6dfbf0158e3fac327b4bcf19a2660aa3262bedf10f35091e73bc3
SSDEEP

24576:0NaBxCytrj+nMJlWqLKTQ0pa3r9aD0zWursFVhWE+M6PObbb1Fq3q9n6nZPt45cx:0NaBsytr9FLKTQ0pa5ax3VhWE+M6PObw

Score

10^/10

redline torrentold infostealer

Malware Config

Extracted

Family

redline

Botnet

TORRENTOLD

amrican-sport-live-stream.cc:4581

Attributes

auth_value
74e1b58bf920611f04c0e3919954fe05

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

description	pid	process	target process
PID 1160 set thread context of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3352 4660 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
3352	4660	WerFault.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

pid	process
1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe
1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

description pid process

Token: SeDebugPrivilege 1160 bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

description	pid	process
Token: SeDebugPrivilege	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe

description	pid	process	target process
PID 1160 wrote to memory of 3140	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 3140	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 3140	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe
PID 1160 wrote to memory of 4660	1160	bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe
"C:\Users\Admin\AppData\Local\Temp\bcadc49beaceeb27068906d6673923c24c12ff73914d6a5ebb66e054565f41fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:3140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 900
3⤵
- Program crash
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4660 -ip 4660
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-133-0x0000000000E00000-0x0000000000EEC000-memory.dmp

Filesize
944KB

Download
memory/1160-134-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/1160-135-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/1160-136-0x0000000005770000-0x000000000577A000-memory.dmp

Filesize
40KB

Download
memory/1160-137-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/1160-138-0x0000000008440000-0x0000000008462000-memory.dmp

Filesize
136KB

Download
memory/1160-139-0x00000000385C0000-0x0000000038626000-memory.dmp

Filesize
408KB

Download
memory/4660-140-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download