Analysis
-
max time kernel
172s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 22:37
Static task
static1
Behavioral task
behavioral1
Sample
54a764920f77d7fa6e0362c87fef1a00.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
54a764920f77d7fa6e0362c87fef1a00.exe
Resource
win10v2004-20240226-en
General
-
Target
54a764920f77d7fa6e0362c87fef1a00.exe
-
Size
1.3MB
-
MD5
54a764920f77d7fa6e0362c87fef1a00
-
SHA1
bf50ce0c1086fe415dea79aecc1f484922a3a723
-
SHA256
5e9bcca94777fe32ffbf38991c2d7123b26bc0e7bc7a347683f66d19d298fa57
-
SHA512
3839b7344a2ca58bc9bc0bd89cc05325aa009f013865728c237f2d26a56c430a07b71aa5a36e503393e48ba592f3a3d245d5df117f117735406e2a9c157da4fb
-
SSDEEP
24576:U+f89nBWLj7rv8/VOWEsS0rfB2f4w/mWCOjwWKQBXFoLi:UAKnBs7rmVEkbfM9CxGX2L
Malware Config
Extracted
redline
1
77.221.156.45:18734
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
54a764920f77d7fa6e0362c87fef1a00.exepid process 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe 3176 54a764920f77d7fa6e0362c87fef1a00.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
54a764920f77d7fa6e0362c87fef1a00.exepid process 3176 54a764920f77d7fa6e0362c87fef1a00.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3176-0-0x00000000009B0000-0x0000000000D84000-memory.dmpFilesize
3.8MB
-
memory/3176-2-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/3176-3-0x00000000009B0000-0x0000000000D84000-memory.dmpFilesize
3.8MB
-
memory/3176-4-0x00000000009B0000-0x0000000000D84000-memory.dmpFilesize
3.8MB
-
memory/3176-5-0x0000000006030000-0x00000000065D4000-memory.dmpFilesize
5.6MB
-
memory/3176-6-0x0000000005B60000-0x0000000005BF2000-memory.dmpFilesize
584KB
-
memory/3176-7-0x0000000005DD0000-0x0000000005DE0000-memory.dmpFilesize
64KB
-
memory/3176-9-0x00000000009B0000-0x0000000000D84000-memory.dmpFilesize
3.8MB
-
memory/3176-10-0x0000000005B30000-0x0000000005B3A000-memory.dmpFilesize
40KB
-
memory/3176-11-0x0000000006F00000-0x0000000007518000-memory.dmpFilesize
6.1MB
-
memory/3176-12-0x0000000008890000-0x000000000899A000-memory.dmpFilesize
1.0MB
-
memory/3176-13-0x0000000006EB0000-0x0000000006EC2000-memory.dmpFilesize
72KB
-
memory/3176-14-0x00000000087C0000-0x00000000087FC000-memory.dmpFilesize
240KB
-
memory/3176-15-0x0000000008800000-0x000000000884C000-memory.dmpFilesize
304KB
-
memory/3176-17-0x0000000073D50000-0x0000000074500000-memory.dmpFilesize
7.7MB
-
memory/3176-19-0x0000000005DD0000-0x0000000005DE0000-memory.dmpFilesize
64KB