redline | 0d3870d43882a263c0511d1f89fbae94912261a6be64dc949d87cdad8f3a7de8

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
Size

315KB
MD5

290b0115d137ba7f6f75557dea9a3418
SHA1

4fd841d032858a7bc39d598eca329371bc48a118
SHA256

51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7
SHA512

b843b5beea655f803deb8473cb9ed4f06e0d99c46480dcce39d321b1bcb4b4dff4350bd7c41f6ca0f3eaae31e73e9351ec5de920eddfedc809f119effe362a34
SSDEEP

6144:8A9pI60nbM8uPZy3+8KIDJgu+PchgHadTi7ZiEfXHS:H9+60nbnueg3cy6RFEPHS

Score

10^/10

redline 7001210066 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

7001210066

https://pastebin.com/raw/KE5Mft0T

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral10/memory/3016-0-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
991	pastebin.com
1005	pastebin.com
533	pastebin.com
622	pastebin.com
498	pastebin.com
749	pastebin.com
909	pastebin.com
970	pastebin.com
1078	pastebin.com
48	pastebin.com
401	pastebin.com
1246	pastebin.com
179	pastebin.com
1240	pastebin.com
147	pastebin.com
320	pastebin.com
823	pastebin.com
241	pastebin.com
840	pastebin.com
601	pastebin.com
1137	pastebin.com
1218	pastebin.com
45	pastebin.com
598	pastebin.com
484	pastebin.com
488	pastebin.com
663	pastebin.com
700	pastebin.com
767	pastebin.com
958	pastebin.com
101	pastebin.com
464	pastebin.com
167	pastebin.com
384	pastebin.com
380	pastebin.com
689	pastebin.com
839	pastebin.com
97	pastebin.com
215	pastebin.com
868	pastebin.com
525	pastebin.com
528	pastebin.com
833	pastebin.com
984	pastebin.com
251	pastebin.com
744	pastebin.com
1203	pastebin.com
204	pastebin.com
1173	pastebin.com
669	pastebin.com
884	pastebin.com
904	pastebin.com
927	pastebin.com
1192	pastebin.com
342	pastebin.com
497	pastebin.com
290	pastebin.com
637	pastebin.com
732	pastebin.com
763	pastebin.com
43	pastebin.com
120	pastebin.com
513	pastebin.com
563	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3016	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86
PID 1540 wrote to memory of 3016	1540	51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe	86

C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe
"C:\Users\Admin\AppData\Local\Temp\51b44e7fef51fc7ece012253c1667cd5cb95636d10007d0e2be5e98e7fd405e7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3016-1-0x000000007410E000-0x000000007410F000-memory.dmp

Filesize
4KB

Download
memory/3016-2-0x0000000005230000-0x0000000005296000-memory.dmp

Filesize
408KB

Download
memory/3016-3-0x0000000005D50000-0x0000000006368000-memory.dmp

Filesize
6.1MB

Download
memory/3016-4-0x00000000057D0000-0x00000000057E2000-memory.dmp

Filesize
72KB

Download
memory/3016-5-0x0000000005900000-0x0000000005A0A000-memory.dmp

Filesize
1.0MB

Download
memory/3016-6-0x0000000074100000-0x00000000748B0000-memory.dmp

Filesize
7.7MB

Download
memory/3016-7-0x000000007410E000-0x000000007410F000-memory.dmp

Filesize
4KB

Download
memory/3016-8-0x0000000074100000-0x00000000748B0000-memory.dmp

Filesize
7.7MB

Download