redline | 5bd85baa40cb6af22a075edf10fd0a8ad1b488e1b4bd4289e2cd66a3bb4a0fdf

Analysis

max time kernel
1790s
max time network
1798s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 20:21

Target

Software_1.30.1.exe
Size

467KB
MD5

78761714083bfed3a4442e272cd45d4d
SHA1

7bdabb17aff9a7f0a40ffb82c01247ecd86a1f79
SHA256

5bd85baa40cb6af22a075edf10fd0a8ad1b488e1b4bd4289e2cd66a3bb4a0fdf
SHA512

f3aae77edb0790d910195eaba31a83710636edb4bbc3c32cf4268b50348f1ca67391460c9f15352b78645d0a7ba0ffb0020ad08bd96fcd64ef172f6f6be89296
SSDEEP

12288:l41RqMw8LxT6hIshPRIrDiWVnpP50V/HPQyHqj00FeQNSI:l4XqMiuiP2amnV57AqhjR

Score

10^/10

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000240000-0x00000000002B9000-memory.dmp	family_zgrat_v1
behavioral2/memory/4772-1-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1
behavioral2/memory/4660-3-0x0000000000240000-0x00000000002B9000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000240000-0x00000000002B9000-memory.dmp	family_redline
behavioral2/memory/4772-1-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral2/memory/4660-3-0x0000000000240000-0x00000000002B9000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 4772	4660	Software_1.30.1.exe	87

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1792	4660	Software_1.30.1.exe	85
PID 4660 wrote to memory of 1792	4660	Software_1.30.1.exe	85
PID 4660 wrote to memory of 1792	4660	Software_1.30.1.exe	85
PID 4660 wrote to memory of 3196	4660	Software_1.30.1.exe	86
PID 4660 wrote to memory of 3196	4660	Software_1.30.1.exe	86
PID 4660 wrote to memory of 3196	4660	Software_1.30.1.exe	86
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87
PID 4660 wrote to memory of 4772	4660	Software_1.30.1.exe	87

C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe
"C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

memory/4660-3-0x0000000000240000-0x00000000002B9000-memory.dmp

Filesize
484KB

Download
memory/4660-0-0x0000000000240000-0x00000000002B9000-memory.dmp

Filesize
484KB

Download
memory/4772-7-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/4772-4-0x0000000074190000-0x0000000074940000-memory.dmp

Filesize
7.7MB

Download
memory/4772-5-0x00000000054D0000-0x0000000005A74000-memory.dmp

Filesize
5.6MB

Download
memory/4772-6-0x0000000004FC0000-0x0000000005052000-memory.dmp

Filesize
584KB

Download
memory/4772-1-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4772-8-0x0000000004F50000-0x0000000004F5A000-memory.dmp

Filesize
40KB

Download
memory/4772-9-0x0000000006560000-0x0000000006B78000-memory.dmp

Filesize
6.1MB

Download
memory/4772-10-0x00000000060D0000-0x00000000061DA000-memory.dmp

Filesize
1.0MB

Download
memory/4772-11-0x0000000006000000-0x0000000006012000-memory.dmp

Filesize
72KB

Download
memory/4772-12-0x0000000006060000-0x000000000609C000-memory.dmp

Filesize
240KB

Download
memory/4772-13-0x00000000061E0000-0x000000000622C000-memory.dmp

Filesize
304KB

Download
memory/4772-14-0x0000000074190000-0x0000000074940000-memory.dmp

Filesize
7.7MB

Download
memory/4772-15-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download