Overview
overview
10Static
static
3061ed335bc...9b.exe
windows7-x64
3061ed335bc...9b.exe
windows10-2004-x64
10067e5c3ecf...b6.exe
windows10-2004-x64
101ec8ce9ace...96.exe
windows10-2004-x64
10349cf4c964...66.exe
windows10-2004-x64
104250b0250d...ee.exe
windows10-2004-x64
1056dbfb10e0...5d.exe
windows10-2004-x64
105951daaf24...9a.exe
windows10-2004-x64
1059c1607382...01.exe
windows10-2004-x64
1074cf5b47d1...8d.exe
windows10-2004-x64
10795a49ee81...4a.exe
windows10-2004-x64
108b549a8688...5b.exe
windows10-2004-x64
1091da85daf6...d8.exe
windows10-2004-x64
10a8dffd83e4...8a.exe
windows10-2004-x64
7ab124875ee...6a.exe
windows10-2004-x64
10ccc5c313f4...94.exe
windows10-2004-x64
10cce5498639...83.exe
windows10-2004-x64
10ce9f75c073...16.exe
windows10-2004-x64
10dda511575f...2f.exe
windows10-2004-x64
10eb81f341bc...da.exe
windows10-2004-x64
10f943251c5b...1b.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 17:27
Static task
static1
Behavioral task
behavioral1
Sample
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
067e5c3ecff330d7c89e0a5c37fec8e0f642f8b31f9a396325cc5782eaa456b6.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
349cf4c964ecebee87078b30505525ffc97ba82548f3193c0d6347693c8ad666.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
4250b0250d540350db8a017ad70a9992b46d70a0d5ab9438c3c0597af56f27ee.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
5951daaf249b9db6c83832a3b7a244dffb52f45eb746f6edb9a2315fe8e4349a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
59c1607382fbf89bf1ce30ceb0a4e1724a81c2e855e91e5f12e07c396e822a01.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
74cf5b47d1d63bb3f8b3b593ca7e2fe868afb92a8d82b4631bae9e2d0eb2398d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
8b549a868852eb291819180cd971dd7b163003efa16b8efacf685d2d5f879a5b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
91da85daf6df1f2a381493425471c65c1caf622791472ee7e1e7d551d4d611d8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
a8dffd83e4ed96b525aa095a5fdbe826aa6409b97419dc8c1ab463bac16a438a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ab124875eee3aa9c0b98e5ed0dbab9856acaf99e011d97b92abd4d2cf0f5aa6a.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ccc5c313f416465ffc57b4343c6e512d0568f618620aaa7b258b5d5721aaf394.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
cce5498639767f010fc7b6b7a5e2ae7c721720e093acf7ad8ec6bd81e63ab983.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
dda511575fe2d4e8cc7e7dfbf500a529cbd2a5acc24299b8217d603401322c2f.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
f943251c5b3ff162faabeb09676429800f82298b7971cbfb3dee652de07b391b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe
-
Size
274KB
-
MD5
6c4def0b3cbfee0d4bef19b45a66497f
-
SHA1
3a7c9a3488652361ee05e7ec4c188c8547403427
-
SHA256
061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b
-
SHA512
2d2ea7bb5e71b763139dd49249d7c76e0285e64024ae1c7a3dc916bc59d86251dc4746cea70622b7248c1b35e2885d1115ec890c3ae008f5ca45dbfc14e1dd29
-
SSDEEP
6144:N4lAc4+AxvS28hwm2UgDqNpwIeitNYvsJywpB:NEAcDLwBjQqBit//pB
Malware Config
Extracted
redline
5345987420
https://pastebin.com/raw/KE5Mft0T
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4156-0-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 172 pastebin.com 176 pastebin.com 190 pastebin.com 257 pastebin.com 447 pastebin.com 664 pastebin.com 804 pastebin.com 93 pastebin.com 813 pastebin.com 275 pastebin.com 579 pastebin.com 741 pastebin.com 213 pastebin.com 550 pastebin.com 604 pastebin.com 695 pastebin.com 426 pastebin.com 99 pastebin.com 195 pastebin.com 412 pastebin.com 557 pastebin.com 648 pastebin.com 658 pastebin.com 668 pastebin.com 42 pastebin.com 805 pastebin.com 800 pastebin.com 151 pastebin.com 320 pastebin.com 391 pastebin.com 109 pastebin.com 293 pastebin.com 342 pastebin.com 640 pastebin.com 674 pastebin.com 192 pastebin.com 748 pastebin.com 643 pastebin.com 806 pastebin.com 828 pastebin.com 50 pastebin.com 511 pastebin.com 799 pastebin.com 107 pastebin.com 125 pastebin.com 138 pastebin.com 227 pastebin.com 396 pastebin.com 454 pastebin.com 480 pastebin.com 582 pastebin.com 8 pastebin.com 208 pastebin.com 444 pastebin.com 734 pastebin.com 181 pastebin.com 75 pastebin.com 309 pastebin.com 343 pastebin.com 411 pastebin.com 527 pastebin.com 580 pastebin.com 662 pastebin.com 67 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4564 set thread context of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 4796 4564 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4156 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4156 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4564 wrote to memory of 1844 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 83 PID 4564 wrote to memory of 1844 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 83 PID 4564 wrote to memory of 1844 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 83 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84 PID 4564 wrote to memory of 4156 4564 061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"C:\Users\Admin\AppData\Local\Temp\061ed335bcb896e77ccede19faa208e6e0bb34be9b0a811676474ad16869699b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 3602⤵
- Program crash
PID:4796
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 45641⤵PID:2904