redline | 2fd37ed834b6cd3747f1017ee09b3f97170245f59f9f2ed37c15b62580623319

Analysis

max time kernel
13s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 16:10

Target

crypted.exe
Size

412KB
MD5

3c9da20ad78d24df53b661b7129959e0
SHA1

e7956e819cc1d2abafb2228a10cf22b9391fb611
SHA256

2fd37ed834b6cd3747f1017ee09b3f97170245f59f9f2ed37c15b62580623319
SHA512

1a02da1652a2c00df33eceda0706adebb5a5f1c3c05e30a09857c94d2fbb93e570f768af5d6648d3a5d11eea3b5c4b1ceb9393fc05248f1eefd96e17f3bbe1b4
SSDEEP

12288:eDmrLy4dMMrASo/n7zUvOTdlzAarl6LmH6RPz5N:um9MMo7zUKdlzlJ62qPP

Score

10^/10

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 2972	4284	crypted.exe	85

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3584	4284	crypted.exe	84
PID 4284 wrote to memory of 3584	4284	crypted.exe	84
PID 4284 wrote to memory of 3584	4284	crypted.exe	84
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85
PID 4284 wrote to memory of 2972	4284	crypted.exe	85

C:\Users\Admin\AppData\Local\Temp\crypted.exe
"C:\Users\Admin\AppData\Local\Temp\crypted.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2972

memory/2972-10-0x00000000751B0000-0x0000000075960000-memory.dmp

Filesize
7.7MB

Download
memory/2972-5-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2972-11-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/2972-13-0x0000000005660000-0x0000000005672000-memory.dmp

Filesize
72KB

Download
memory/2972-12-0x0000000005BF0000-0x0000000006208000-memory.dmp

Filesize
6.1MB

Download
memory/2972-14-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/2972-15-0x00000000056C0000-0x00000000056FC000-memory.dmp

Filesize
240KB

Download
memory/2972-16-0x0000000005720000-0x000000000576C000-memory.dmp

Filesize
304KB

Download
memory/4284-0-0x00000000008A0000-0x000000000090C000-memory.dmp

Filesize
432KB

Download
memory/4284-2-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/4284-6-0x0000000002D50000-0x0000000004D50000-memory.dmp

Filesize
32.0MB

Download
memory/4284-1-0x00000000751B0000-0x0000000075960000-memory.dmp

Filesize
7.7MB

Download
memory/4284-9-0x00000000751B0000-0x0000000075960000-memory.dmp

Filesize
7.7MB

Download