Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-04-2024 04:28
Static task
static1
Behavioral task
behavioral1
Sample
dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe
Resource
win10-20240404-en
windows10-1703-x64
5 signatures
300 seconds
General
-
Target
dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe
-
Size
366KB
-
MD5
a6ab529f1914ad87d2c89499d1104998
-
SHA1
ce3497864d3bb643ffd0363f2c93a84e2e107479
-
SHA256
dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9
-
SHA512
974d51119c33547eabd2be1d2aa158cf53122453a5c44feec600dd181dffd7b8d35f05554b4e78c32c00863de0a9ed89884b7bf0079cc3babcbff0e6a68c9c93
-
SSDEEP
6144:4+S5/gDN9Xpk9qDl6lc+EuK9ADesFTCuFkgKq1x3TBmHM:4+c4xk9g6W59ACwT9CqAHM
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3632-4-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 420 set thread context of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeBackupPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe Token: SeSecurityPrivilege 3632 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74 PID 420 wrote to memory of 3632 420 dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe"C:\Users\Admin\AppData\Local\Temp\dec6d4fada6cfe3ccdd63e6706e4e7d0fc440d865921616821e6db0f3b3b39c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632
-