Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 21:26
Static task
static1
Behavioral task
behavioral1
Sample
5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39.exe
Resource
win10v2004-20231215-en
General
-
Target
5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39.exe
-
Size
295KB
-
MD5
239a192a49067a4d346bf23bbf861222
-
SHA1
f7adcbb7bdf4d1f55dcdf696d3df8a8fd331d991
-
SHA256
5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39
-
SHA512
e727f76344a2066ae307871c2c3dd65c499fb5704da4f39c134651650f6204a91738d002f8b6d326746e59762053f143edab147784f2901f49e34c8b28b2e3f4
-
SSDEEP
6144:nbklngfPgoKYpzQiW/zfyPG3pxVfGAm3:bLXgxYpgzOMBw
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-6-0x0000000004820000-0x0000000004860000-memory.dmp family_redline behavioral1/memory/1460-4-0x0000000001F50000-0x0000000001F96000-memory.dmp family_redline behavioral1/memory/1460-8-0x0000000004760000-0x00000000047A4000-memory.dmp family_redline behavioral1/memory/1460-9-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-10-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-42-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-72-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-70-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-68-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-66-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-64-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-62-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-60-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-58-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-56-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-54-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-52-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-50-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-48-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-46-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-44-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-40-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-38-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-36-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-34-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-32-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-30-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-28-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-26-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-24-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-22-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-20-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-18-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-16-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-14-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-12-0x0000000004760000-0x000000000479F000-memory.dmp family_redline behavioral1/memory/1460-915-0x0000000004820000-0x0000000004860000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39.exedescription pid process Token: SeDebugPrivilege 1460 5c99ef699747201b9880942497aec5caaec6a214dd0e3ba8e26373d380561b39.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1460-3-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1460-2-0x0000000000220000-0x000000000026B000-memory.dmpFilesize
300KB
-
memory/1460-1-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/1460-5-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/1460-6-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1460-4-0x0000000001F50000-0x0000000001F96000-memory.dmpFilesize
280KB
-
memory/1460-7-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1460-8-0x0000000004760000-0x00000000047A4000-memory.dmpFilesize
272KB
-
memory/1460-9-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-10-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-42-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-72-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-70-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-68-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-66-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-64-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-62-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-60-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-58-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-56-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-54-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-52-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-50-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-48-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-46-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-44-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-40-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-38-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-36-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-34-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-32-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-30-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-28-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-26-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-24-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-22-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-20-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-18-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-16-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-14-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-12-0x0000000004760000-0x000000000479F000-memory.dmpFilesize
252KB
-
memory/1460-915-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1460-917-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/1460-918-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/1460-920-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1460-921-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB