redline | 1aaf4b8d96ab060b1f8a1cf8a7092e0f57c03cd90904e8ad0f04915cef8f1f4b

Analysis

max time kernel
233s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe
Size

707KB
MD5

c920a8fc975ab6f609a3e20a1f23e43d
SHA1

4c7f42446ebdf228963b974c510e63147c2ad25d
SHA256

c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11
SHA512

6322121341a623706dc5d9d905d4d446247d8123530c18346f484732ed00eb17472f73645ee59bf6319ac5e3b6a20cc6e7c55ba4e24d79612539f8793a80e5d4
SSDEEP

12288:ewq1od3iYcPbkbftLgBjJj3MUZE+7+wEExPw8M2QlOG0jJAI8XjrYdLjaPh:qbGf+IUyaiEe12U0jWB3kmPh

Score

10^/10

redline zgrat infostealer rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4820-0-0x0000000000E20000-0x0000000000ED8000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4624-5-0x0000000000400000-0x000000000048C000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4820 set thread context of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	RegAsm.exe
Token: SeBackupPrivilege	4624	RegAsm.exe
Token: SeSecurityPrivilege	4624	RegAsm.exe
Token: SeSecurityPrivilege	4624	RegAsm.exe
Token: SeSecurityPrivilege	4624	RegAsm.exe
Token: SeSecurityPrivilege	4624	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95
PID 4820 wrote to memory of 4624	4820	c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe	95

C:\Users\Admin\AppData\Local\Temp\c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe
"C:\Users\Admin\AppData\Local\Temp\c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-19-0x0000000006E00000-0x0000000006E12000-memory.dmp

Filesize
72KB

Download
memory/4624-15-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/4624-24-0x0000000006B40000-0x0000000006B5E000-memory.dmp

Filesize
120KB

Download
memory/4624-5-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/4624-23-0x0000000008F00000-0x0000000008F76000-memory.dmp

Filesize
472KB

Download
memory/4624-22-0x0000000008580000-0x00000000085E6000-memory.dmp

Filesize
408KB

Download
memory/4624-10-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4624-11-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/4624-12-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/4624-13-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4624-21-0x00000000082C0000-0x000000000830C000-memory.dmp

Filesize
304KB

Download
memory/4624-16-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/4624-14-0x0000000005780000-0x0000000005790000-memory.dmp

Filesize
64KB

Download
memory/4624-17-0x00000000088E0000-0x0000000008EF8000-memory.dmp

Filesize
6.1MB

Download
memory/4624-18-0x00000000083D0000-0x00000000084DA000-memory.dmp

Filesize
1.0MB

Download
memory/4624-20-0x0000000006EF0000-0x0000000006F2C000-memory.dmp

Filesize
240KB

Download
memory/4820-0-0x0000000000E20000-0x0000000000ED8000-memory.dmp

Filesize
736KB

Download
memory/4820-1-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4820-9-0x00000000745A0000-0x0000000074D50000-memory.dmp

Filesize
7.7MB

Download
memory/4820-7-0x00000000031A0000-0x00000000051A0000-memory.dmp

Filesize
32.0MB

Download
memory/4820-2-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download