redline | cd76a354a02015517a2b50d75aa3b68dd0e3164adbb040f6317251016bc62b21

Resubmissions

20-03-2024 23:00

240320-2y4btadd85 10

15-03-2024 20:34

240315-zcmqtscf84 10

Analysis

max time kernel
589s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe
Size

2.9MB
MD5

41b2380b454cfa680b4d2b30440e8109
SHA1

f767fbbf9ddeb69c69d0cde4927957647e8a019d
SHA256

073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456
SHA512

a2600fd86158ef8481c18acf1a74c961058b4fbf1e9461294eb39475e634fbbcdea1f60b28cbc8669cd7be17f6406743834b137f44169c3a455f7551d7164421
SSDEEP

12288:opUCj2KN8HnbttOCHfVNWDO2wF6edg0ASy0EPmLUd0btZcodN2BOjDyhC:opUCjobH9kDPww0QSyk0FhC

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

168.119.228.126:11552

Attributes

auth_value
ee2d0ef2a4d0cbee5b6303070e44cb8a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral8/memory/2824-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1140	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106
PID 4856 wrote to memory of 2824	4856	073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe	106

C:\Users\Admin\AppData\Local\Temp\073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe
"C:\Users\Admin\AppData\Local\Temp\073731fa5a5ef41b39784ec7db9846f1286d7000add6c0b5dd20357c81e23456.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2824

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-58-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-59-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-85-0x000001634CD90000-0x000001634CD91000-memory.dmp

Filesize
4KB

Download
memory/1140-50-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-83-0x000001634CC80000-0x000001634CC81000-memory.dmp

Filesize
4KB

Download
memory/1140-81-0x000001634CC70000-0x000001634CC71000-memory.dmp

Filesize
4KB

Download
memory/1140-69-0x000001634CA70000-0x000001634CA71000-memory.dmp

Filesize
4KB

Download
memory/1140-66-0x000001634CB30000-0x000001634CB31000-memory.dmp

Filesize
4KB

Download
memory/1140-49-0x000001634CEF0000-0x000001634CEF1000-memory.dmp

Filesize
4KB

Download
memory/1140-63-0x000001634CB40000-0x000001634CB41000-memory.dmp

Filesize
4KB

Download
memory/1140-60-0x000001634CB40000-0x000001634CB41000-memory.dmp

Filesize
4KB

Download
memory/1140-61-0x000001634CB30000-0x000001634CB31000-memory.dmp

Filesize
4KB

Download
memory/1140-57-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-51-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-55-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-54-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-17-0x0000016344840000-0x0000016344850000-memory.dmp

Filesize
64KB

Download
memory/1140-33-0x0000016344940000-0x0000016344950000-memory.dmp

Filesize
64KB

Download
memory/1140-53-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-84-0x000001634CC80000-0x000001634CC81000-memory.dmp

Filesize
4KB

Download
memory/1140-56-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/1140-52-0x000001634CF10000-0x000001634CF11000-memory.dmp

Filesize
4KB

Download
memory/2824-7-0x0000000005BC0000-0x00000000061D8000-memory.dmp

Filesize
6.1MB

Download
memory/2824-11-0x00000000056D0000-0x000000000570C000-memory.dmp

Filesize
240KB

Download
memory/2824-15-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/2824-10-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/2824-12-0x0000000005850000-0x000000000589C000-memory.dmp

Filesize
304KB

Download
memory/2824-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2824-9-0x0000000005670000-0x0000000005682000-memory.dmp

Filesize
72KB

Download
memory/2824-16-0x00000000059D0000-0x00000000059E0000-memory.dmp

Filesize
64KB

Download
memory/2824-8-0x0000000005740000-0x000000000584A000-memory.dmp

Filesize
1.0MB

Download
memory/2824-4-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-14-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-6-0x0000000001510000-0x00000000015A2000-memory.dmp

Filesize
584KB

Download
memory/4856-5-0x00000000062D0000-0x0000000006874000-memory.dmp

Filesize
5.6MB

Download
memory/4856-0-0x0000000000AF0000-0x0000000000DD2000-memory.dmp

Filesize
2.9MB

Download
memory/4856-1-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download
memory/4856-2-0x0000000074440000-0x0000000074BF0000-memory.dmp

Filesize
7.7MB

Download