Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 20:38
Behavioral task
behavioral1
Sample
Radiogram.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Radiogram.exe
Resource
win10-20240404-en
General
-
Target
Radiogram.exe
-
Size
109KB
-
MD5
5d320d4f2e1bb3153392a5b2c78f0b67
-
SHA1
9df777a1ba6eec52666389f874db9d2bb0c65d18
-
SHA256
617ae2cedb4ba05377589c60efcd1ab10df42f8327229935e6ff6a8d7887ac27
-
SHA512
b32698ad92844d25130f16f6fa0095a50a02017013e1a0f185ed1f1a2e9eaf8cbe7d1f3f226f59ca02bd44e219611a4e647b9da2893a7f81b382533a74b5c820
-
SSDEEP
1536:LAbbDr5JdAmS4lZyNVxCuCk+q6wN4c3oJQpZ6FSnH8Nby+xXm8lMg8HI6T:L87k+q6wN8oaYmyoWv7o6T
Malware Config
Extracted
redline
6077866846
https://pastebin.com/raw/KE5Mft0T
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/1728-0-0x0000000000A10000-0x0000000000A32000-memory.dmp family_redline behavioral1/memory/1728-2-0x000000001A620000-0x000000001A6A0000-memory.dmp family_redline -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 40 pastebin.com 69 pastebin.com 95 pastebin.com 90 pastebin.com 93 pastebin.com 126 pastebin.com 10 pastebin.com 18 pastebin.com 21 pastebin.com 118 pastebin.com 22 pastebin.com 45 pastebin.com 61 pastebin.com 35 pastebin.com 55 pastebin.com 72 pastebin.com 73 pastebin.com 127 pastebin.com 20 pastebin.com 31 pastebin.com 34 pastebin.com 58 pastebin.com 8 pastebin.com 41 pastebin.com 99 pastebin.com 123 pastebin.com 59 pastebin.com 68 pastebin.com 114 pastebin.com 102 pastebin.com 23 pastebin.com 32 pastebin.com 54 pastebin.com 80 pastebin.com 27 pastebin.com 39 pastebin.com 44 pastebin.com 62 pastebin.com 77 pastebin.com 86 pastebin.com 75 pastebin.com 84 pastebin.com 94 pastebin.com 37 pastebin.com 38 pastebin.com 48 pastebin.com 106 pastebin.com 112 pastebin.com 121 pastebin.com 15 pastebin.com 49 pastebin.com 76 pastebin.com 87 pastebin.com 103 pastebin.com 14 pastebin.com 47 pastebin.com 66 pastebin.com 42 pastebin.com 88 pastebin.com 120 pastebin.com 4 pastebin.com 28 pastebin.com 91 pastebin.com 131 pastebin.com -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 Radiogram.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1ACD046796C9A86123D7A217523516861F5BBDC9 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1ACD046796C9A86123D7A217523516861F5BBDC9\Blob = 0f000000010000002000000060720e0ad3e494a30709b7f69caa32bd715c174711d65d6f1170195cf9cff1be0300000001000000140000001acd046796c9a86123d7a217523516861f5bbdc92000000001000000f9020000308202f5308201dda0030201020210353cdaee14323b522401d3b3d0bf5f49300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303430383137303030305a170d3239303430373137303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100e23935eebaa7c8eca8940797dfce1c619b3c84af5c610bd4f2c69eb6c3532cd6210110fd845e1b7e794e671392935ab769749a3bd63e7c4fa74c66c31d2a4e90c0c357aa157c52e54c7559732298e327b9f012f0ad77f326d71ce42862b544d7fe2c5f59981b9eac6804d47a5a8441fa94457c52217a4c35d22e7514fa096bb68aed66b4d1c83b8a997396def0c0b51b798e76254b8d62422ac62d4402456adf5c66c43fcab1341de41a65d3c3111a9fbcdbd3b5635e5191205a4c9c6666df646c6bf4d5146488bd751ea33f4cd4d2e7ac92b3be0685fd9edab3050af5b0838794ece0bbc48782b0335be1de081482ef2315493ac15451144fff143375c9c8af0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604140bfdc642fb797b1cebeaf84342ca1fee121c01c3300d06092a864886f70d01010b05000382010100b1afb3321638dd39e2f971a61f5c6fcc73da82f149ba2446debe117fb99feab708cc87f2dfe8cf8f28b2c575a6c0c292555da1a72f97f861c4c370e117be0aa2ec57479782625c0a8d1ba50a37680a7acabae7296097689299c3a9af52dc270b1deb2564a11147c5b80efb78265ac84d66a8bbbb1456fde603f77ad5923c83565b1d2f3350b1881f838223d868ba8958d99164113a2bcab819cb1df547f6c917a906946c681896e747f392f986e8a580f5852ff77994506d21e0d3c98e92bf57d27641edc514633073fb41d7fc50efdc44ddf9f482c9526cdfa7706407cc47cc29f749da8897b04aec84f3d2641f1ceafb26e3b987e8933f6d47dc432c07a382 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1ACD046796C9A86123D7A217523516861F5BBDC9\Blob = 1400000001000000140000000bfdc642fb797b1cebeaf84342ca1fee121c01c30300000001000000140000001acd046796c9a86123d7a217523516861f5bbdc90f000000010000002000000060720e0ad3e494a30709b7f69caa32bd715c174711d65d6f1170195cf9cff1be2000000001000000f9020000308202f5308201dda0030201020210353cdaee14323b522401d3b3d0bf5f49300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303430383137303030305a170d3239303430373137303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100e23935eebaa7c8eca8940797dfce1c619b3c84af5c610bd4f2c69eb6c3532cd6210110fd845e1b7e794e671392935ab769749a3bd63e7c4fa74c66c31d2a4e90c0c357aa157c52e54c7559732298e327b9f012f0ad77f326d71ce42862b544d7fe2c5f59981b9eac6804d47a5a8441fa94457c52217a4c35d22e7514fa096bb68aed66b4d1c83b8a997396def0c0b51b798e76254b8d62422ac62d4402456adf5c66c43fcab1341de41a65d3c3111a9fbcdbd3b5635e5191205a4c9c6666df646c6bf4d5146488bd751ea33f4cd4d2e7ac92b3be0685fd9edab3050af5b0838794ece0bbc48782b0335be1de081482ef2315493ac15451144fff143375c9c8af0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604140bfdc642fb797b1cebeaf84342ca1fee121c01c3300d06092a864886f70d01010b05000382010100b1afb3321638dd39e2f971a61f5c6fcc73da82f149ba2446debe117fb99feab708cc87f2dfe8cf8f28b2c575a6c0c292555da1a72f97f861c4c370e117be0aa2ec57479782625c0a8d1ba50a37680a7acabae7296097689299c3a9af52dc270b1deb2564a11147c5b80efb78265ac84d66a8bbbb1456fde603f77ad5923c83565b1d2f3350b1881f838223d868ba8958d99164113a2bcab819cb1df547f6c917a906946c681896e747f392f986e8a580f5852ff77994506d21e0d3c98e92bf57d27641edc514633073fb41d7fc50efdc44ddf9f482c9526cdfa7706407cc47cc29f749da8897b04aec84f3d2641f1ceafb26e3b987e8933f6d47dc432c07a382 Radiogram.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\1ACD046796C9A86123D7A217523516861F5BBDC9\Blob = 190000000100000010000000e9302915e21f0541517eb82199104f510f000000010000002000000060720e0ad3e494a30709b7f69caa32bd715c174711d65d6f1170195cf9cff1be0300000001000000140000001acd046796c9a86123d7a217523516861f5bbdc91400000001000000140000000bfdc642fb797b1cebeaf84342ca1fee121c01c32000000001000000f9020000308202f5308201dda0030201020210353cdaee14323b522401d3b3d0bf5f49300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303430383137303030305a170d3239303430373137303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100e23935eebaa7c8eca8940797dfce1c619b3c84af5c610bd4f2c69eb6c3532cd6210110fd845e1b7e794e671392935ab769749a3bd63e7c4fa74c66c31d2a4e90c0c357aa157c52e54c7559732298e327b9f012f0ad77f326d71ce42862b544d7fe2c5f59981b9eac6804d47a5a8441fa94457c52217a4c35d22e7514fa096bb68aed66b4d1c83b8a997396def0c0b51b798e76254b8d62422ac62d4402456adf5c66c43fcab1341de41a65d3c3111a9fbcdbd3b5635e5191205a4c9c6666df646c6bf4d5146488bd751ea33f4cd4d2e7ac92b3be0685fd9edab3050af5b0838794ece0bbc48782b0335be1de081482ef2315493ac15451144fff143375c9c8af0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604140bfdc642fb797b1cebeaf84342ca1fee121c01c3300d06092a864886f70d01010b05000382010100b1afb3321638dd39e2f971a61f5c6fcc73da82f149ba2446debe117fb99feab708cc87f2dfe8cf8f28b2c575a6c0c292555da1a72f97f861c4c370e117be0aa2ec57479782625c0a8d1ba50a37680a7acabae7296097689299c3a9af52dc270b1deb2564a11147c5b80efb78265ac84d66a8bbbb1456fde603f77ad5923c83565b1d2f3350b1881f838223d868ba8958d99164113a2bcab819cb1df547f6c917a906946c681896e747f392f986e8a580f5852ff77994506d21e0d3c98e92bf57d27641edc514633073fb41d7fc50efdc44ddf9f482c9526cdfa7706407cc47cc29f749da8897b04aec84f3d2641f1ceafb26e3b987e8933f6d47dc432c07a382 Radiogram.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1728 Radiogram.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1728 Radiogram.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a