Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 14:18
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240419-en
General
-
Target
file.exe
-
Size
518KB
-
MD5
c15c91c578b84e19b66599a4eaa29636
-
SHA1
2baf692d598ade6f2348fa5a875857abb70e4ca9
-
SHA256
dee9ad32eab4891fb956f119086543a5220518547f24794812f42e012b0cc1d4
-
SHA512
2268017aa29e327707f3471957296056c496c7ba835c6ddca7f4bed59b1882d93bbaab46c9f4ae1c5ab120f9ceda8a4a096566ad37b23103829676c8cf3b7d77
-
SSDEEP
12288:pbA9s8w7P9Ca47E6uUlVGd7KaL7mTIFc/K9lTdovsC:KsDb4nKwaXmMy/K/Th
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
5.42.65.96:28380
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1520-1-0x0000000000260000-0x00000000002E6000-memory.dmp family_redline behavioral2/memory/3408-0-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file.exedescription pid process target process PID 1520 set thread context of 3408 1520 file.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
RegAsm.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 RegAsm.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
file.exedescription pid process target process PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe PID 1520 wrote to memory of 3408 1520 file.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Modifies system certificate store
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Tmp3662.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
memory/1520-1-0x0000000000260000-0x00000000002E6000-memory.dmpFilesize
536KB
-
memory/3408-24-0x00000000061A0000-0x0000000006216000-memory.dmpFilesize
472KB
-
memory/3408-25-0x0000000006930000-0x000000000694E000-memory.dmpFilesize
120KB
-
memory/3408-5-0x0000000005540000-0x00000000055D2000-memory.dmpFilesize
584KB
-
memory/3408-6-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/3408-7-0x00000000055E0000-0x00000000055EA000-memory.dmpFilesize
40KB
-
memory/3408-3-0x0000000074C10000-0x00000000753C0000-memory.dmpFilesize
7.7MB
-
memory/3408-0-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/3408-4-0x0000000005AF0000-0x0000000006094000-memory.dmpFilesize
5.6MB
-
memory/3408-28-0x0000000006F70000-0x0000000007588000-memory.dmpFilesize
6.1MB
-
memory/3408-29-0x0000000006AC0000-0x0000000006BCA000-memory.dmpFilesize
1.0MB
-
memory/3408-30-0x0000000006A00000-0x0000000006A12000-memory.dmpFilesize
72KB
-
memory/3408-31-0x0000000006A60000-0x0000000006A9C000-memory.dmpFilesize
240KB
-
memory/3408-32-0x0000000006BD0000-0x0000000006C1C000-memory.dmpFilesize
304KB
-
memory/3408-33-0x0000000074C10000-0x00000000753C0000-memory.dmpFilesize
7.7MB
-
memory/3408-34-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB