Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 20:05
Static task
static1
Behavioral task
behavioral1
Sample
37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8.exe
Resource
win10v2004-20240226-en
General
-
Target
37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8.exe
-
Size
370KB
-
MD5
7f61e4726800c88a8f85d5f8d6bdf0bc
-
SHA1
616b8d4b050f3c0169fc5d289a51f7799f457d69
-
SHA256
37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8
-
SHA512
2644cf300ab314a19b92515c05778b6bafe40368d0d7d6d83e4b6a84d5fade4d247397568c2151a5a28b79ab5022c2ae349b6ece6ba1f4bb6cd212a4019547cf
-
SSDEEP
6144:YZQI+pqoikfTHxW7tYmab2t0PRDpbfKMBphGaW:YZQI+YFkfTHT3TBfKMBpU
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-5-0x0000000002320000-0x0000000002366000-memory.dmp family_redline behavioral1/memory/2324-6-0x0000000004D80000-0x0000000004DC0000-memory.dmp family_redline behavioral1/memory/2324-8-0x00000000024C0000-0x0000000002504000-memory.dmp family_redline behavioral1/memory/2324-9-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-10-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-12-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-14-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-16-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-18-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-20-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-24-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-26-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-28-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-32-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-34-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-38-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-44-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-48-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-50-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-54-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-56-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-62-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-64-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-68-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-70-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-72-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-66-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-60-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-58-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-52-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-46-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-42-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-40-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-36-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-30-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline behavioral1/memory/2324-22-0x00000000024C0000-0x00000000024FF000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8.exedescription pid process Token: SeDebugPrivilege 2324 37c6e6cc10937a46555291f21f1d046dbf238940edde08ca817d08c7aaf391c8.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-1-0x00000000009F0000-0x0000000000AF0000-memory.dmpFilesize
1024KB
-
memory/2324-2-0x0000000000220000-0x000000000026B000-memory.dmpFilesize
300KB
-
memory/2324-3-0x0000000000400000-0x0000000000811000-memory.dmpFilesize
4.1MB
-
memory/2324-4-0x0000000074D60000-0x000000007544E000-memory.dmpFilesize
6.9MB
-
memory/2324-5-0x0000000002320000-0x0000000002366000-memory.dmpFilesize
280KB
-
memory/2324-6-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/2324-7-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/2324-8-0x00000000024C0000-0x0000000002504000-memory.dmpFilesize
272KB
-
memory/2324-9-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-10-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-12-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-14-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-16-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-18-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-20-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-24-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-26-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-28-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-32-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-34-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-38-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-44-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-48-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-50-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-54-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-56-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-62-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-64-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-68-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-70-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-72-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-66-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-60-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-58-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-52-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-46-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-42-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-40-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-36-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-30-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-22-0x00000000024C0000-0x00000000024FF000-memory.dmpFilesize
252KB
-
memory/2324-915-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/2324-917-0x00000000009F0000-0x0000000000AF0000-memory.dmpFilesize
1024KB
-
memory/2324-918-0x0000000074D60000-0x000000007544E000-memory.dmpFilesize
6.9MB
-
memory/2324-919-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/2324-921-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB
-
memory/2324-922-0x0000000004D80000-0x0000000004DC0000-memory.dmpFilesize
256KB