redline | 292b6242a8248f18030260bd0c373ec14be1362f7f7494bca33e42fcc97580b0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:56

Target

d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe
Size

454KB
MD5

b7f76ced093ca9f03e791a1aeb35ed16
SHA1

ad59e7878fe7c94341ee5dad7b3950d168d5a97b
SHA256

d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765
SHA512

23fd42c33e514c2f21d4ea7fa40c7d3bd94da1fb7bad693e9e3d080310e793b82f35eea8912f7c1619e4705cf4976f892d87955e5e9c7a95d80bf6e8f888a1a2
SSDEEP

6144:ejo7W76rH+prJpH0AY3DYu+e3i27figCzqIU6vdpgRNmeBKZ4cyox1ZS/n4FPCKv:ez76rH+prJpUpYRlq2ejIZNDE/8PfeE

Score

10^/10

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral19/memory/1512-0-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral19/memory/1512-0-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4516 set thread context of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81
PID 4516 wrote to memory of 1512	4516	d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe	81

C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe
"C:\Users\Admin\AppData\Local\Temp\d49a64853d7fdb5d663df0941d5488cd6e080c07ea46f31a0326e2e0ab34f765.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1512

memory/1512-6-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/1512-8-0x0000000006200000-0x000000000630A000-memory.dmp

Filesize
1.0MB

Download
memory/1512-2-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/1512-3-0x0000000005660000-0x0000000005C04000-memory.dmp

Filesize
5.6MB

Download
memory/1512-4-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/1512-5-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/1512-0-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1512-13-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/1512-10-0x0000000006190000-0x00000000061CC000-memory.dmp

Filesize
240KB

Download
memory/1512-9-0x0000000006130000-0x0000000006142000-memory.dmp

Filesize
72KB

Download
memory/1512-7-0x0000000006680000-0x0000000006C98000-memory.dmp

Filesize
6.1MB

Download
memory/1512-11-0x0000000006310000-0x000000000635C000-memory.dmp

Filesize
304KB

Download
memory/1512-12-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/4516-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download