redline | 7cc4ca7df1354c5dcc6727cacfda8e239f161845dfb3a7cb9889f29fad4b792a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe
Size

968KB
MD5

001fd77dc866551558dbdabe0918c8fe
SHA1

ee2bc863795256c1573dce130ff05d9e0aa4778b
SHA256

7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495
SHA512

459497de8b051b9086e7d3a57fa06a50903666e61fb2a9815c80692b525821c4bcb75a44eea540aad9cb6214bf646d5a533496353373de616cd8656dc6cb7da6
SSDEEP

12288:d4r/VjTk4fZ0JeFGdfIBmq4KRl8EtDYzbYzTL2dpuwiuZndFmhqVJxMI:o/lTk4fZ0JpdfIBm8IgTLBwUu7MI

Score

10^/10

redline 6077866846 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

6077866846

https://pastebin.com/raw/KE5Mft0T

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral14/memory/3332-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
460	pastebin.com
35	pastebin.com
47	pastebin.com
219	pastebin.com
325	pastebin.com
353	pastebin.com
426	pastebin.com
427	pastebin.com
528	pastebin.com
192	pastebin.com
294	pastebin.com
345	pastebin.com
359	pastebin.com
392	pastebin.com
202	pastebin.com
292	pastebin.com
320	pastebin.com
554	pastebin.com
23	pastebin.com
101	pastebin.com
171	pastebin.com
351	pastebin.com
523	pastebin.com
156	pastebin.com
214	pastebin.com
271	pastebin.com
650	pastebin.com
237	pastebin.com
582	pastebin.com
586	pastebin.com
649	pastebin.com
145	pastebin.com
389	pastebin.com
416	pastebin.com
493	pastebin.com
44	pastebin.com
130	pastebin.com
149	pastebin.com
201	pastebin.com
230	pastebin.com
454	pastebin.com
481	pastebin.com
502	pastebin.com
9	pastebin.com
113	pastebin.com
213	pastebin.com
255	pastebin.com
400	pastebin.com
547	pastebin.com
660	pastebin.com
38	pastebin.com
90	pastebin.com
186	pastebin.com
216	pastebin.com
494	pastebin.com
363	pastebin.com
27	pastebin.com
312	pastebin.com
477	pastebin.com
499	pastebin.com
169	pastebin.com
266	pastebin.com
464	pastebin.com
66	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3332	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 4492	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	84
PID 2308 wrote to memory of 4492	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	84
PID 2308 wrote to memory of 4492	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	84
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85
PID 2308 wrote to memory of 3332	2308	7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe	85

C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe
"C:\Users\Admin\AppData\Local\Temp\7c81a593c9a2d9ab34fc28f1c121a9133b5584f0f4893ce3b51f6d7fdc040495.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3332-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3332-1-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/3332-2-0x0000000005320000-0x0000000005386000-memory.dmp

Filesize
408KB

Download
memory/3332-3-0x0000000005E80000-0x0000000006498000-memory.dmp

Filesize
6.1MB

Download
memory/3332-5-0x0000000005A00000-0x0000000005B0A000-memory.dmp

Filesize
1.0MB

Download
memory/3332-4-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/3332-6-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/3332-7-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/3332-8-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download