redline | 739d8e382768ca1c159c50425bc7773bc2e7e3d91705fc41d3b32035b2811daa | Triage

Analysis

max time kernel
0s
max time network
5s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 10:10

Sharing

Report Analysis Logs

General

Target

Software_1.30.1.exe
Size

459KB
MD5

1502131d8e2862b1c4c8c32460d5a471
SHA1

661c7dbfffa6c8a03df60e6f9daf1dcfaf9b1591
SHA256

f5c5b3ecadf87600083fa78130c7c046405e542c878a86a144626286dd857349
SHA512

87088e55f5a0fb586771ca0bded9649e790393646036579ebf29ed051af706f24516c261a9a4365d84c675aa8f75b277ccf58eda9a86bd67eb2f1c9edfdb5f4b
SSDEEP

12288:P4J4ZH65jJnZ0iQaNJI0pqIRWqsfedoM/Sk2+JEXRa:w4ZGnhDVqXqsWaM/dbGB

Score

10^/10

redline zgrat infostealer rat

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral31/memory/1968-0-0x00000000009E0000-0x0000000000A57000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral31/memory/1968-0-0x00000000009E0000-0x0000000000A57000-memory.dmp	family_redline

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	1968	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2196	1968	Software_1.30.1.exe	29
PID 1968 wrote to memory of 2196	1968	Software_1.30.1.exe	29
PID 1968 wrote to memory of 2196	1968	Software_1.30.1.exe	29
PID 1968 wrote to memory of 2196	1968	Software_1.30.1.exe	29

C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe
"C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 36
  2⤵
  - Program crash
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x00000000009E0000-0x0000000000A57000-memory.dmp

Filesize
476KB

Download