Overview
overview
10Static
static
31238663077...be.exe
windows10-2004-x64
102176dd1779...68.exe
windows10-2004-x64
1025c57e6714...48.exe
windows7-x64
1025c57e6714...48.exe
windows10-2004-x64
103931c3ca01...c1.exe
windows10-2004-x64
10611b640fd7...5e.exe
windows10-2004-x64
1061ec6f7f31...74.exe
windows10-2004-x64
106c15f1899d...ed.exe
windows10-2004-x64
1075997a0972...ce.exe
windows7-x64
375997a0972...ce.exe
windows10-2004-x64
107a4ee83882...ea.exe
windows10-2004-x64
107b22e6cc31...ce.exe
windows10-2004-x64
108a68d5e2ce...71.exe
windows10-2004-x64
109a72ed316b...b3.exe
windows10-2004-x64
10b2abc74f29...1f.exe
windows10-2004-x64
10b577c897b2...2b.exe
windows10-2004-x64
10ba5c9d840c...7b.exe
windows10-2004-x64
10ba769ab008...cb.exe
windows10-2004-x64
10be7c09289a...43.exe
windows10-2004-x64
10c29b675475...fe.exe
windows10-2004-x64
10f5875e99d2...63.exe
windows7-x64
3f5875e99d2...63.exe
windows10-2004-x64
10fd5bd6afc5...4f.exe
windows10-2004-x64
10Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 12:28
Static task
static1
Behavioral task
behavioral1
Sample
1238663077477c73376048d8230b1c33b6f5f6a62da8a6c1274721591dac70be.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
2176dd177933f7067296700761e340f0aada8c29c352796e3aeb0be5db5e1368.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
25c57e67144c4603cb7936eb9ad62fb4a4b313d0acb99262c66c4792f6ecdf48.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
25c57e67144c4603cb7936eb9ad62fb4a4b313d0acb99262c66c4792f6ecdf48.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
3931c3ca01cc35353f3a071c6ef787511253396b8e24e12cdf7dbbe451ac80c1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
611b640fd7c9e06cb4ffde1db21b1f9ace29ac4c504fc14569faf426b234ec5e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
61ec6f7f3198f2f73155461b5544c1c55e467d0faa1776e05504a411b0530974.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
6c15f1899ddb76b31fda1ef8a7d18f02ebe3c6f0dc3202cb51c180fecb4fcfed.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
75997a0972431bc5e7a704b53cd1a000bf6f1f51c31f2ef32b3af38f120ccfce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
7a4ee8388222f5e129b4d1d82750bea32e3956ea160d1a752dea1af994fa77ea.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
7b22e6cc31710809bbb88f27afa15ad45784dd0ccd3da27be9b6ca3b039a15ce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
8a68d5e2cebc81b87ef22282e4eb9af0b0776fe47cb4a1e39aaed96f3b5fa171.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
9a72ed316bbd2e389eb2ecd7243e5841d041badae874aa11f831b452a7cff8b3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
b2abc74f29ed52ec7d83d19dcdda578b75bfabfe3cb6be161acad9d570a9601f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
b577c897b2be38c4bed293104f5424d9cc6213dcbf6ee85b26b1d55373ce3f2b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
ba5c9d840c93ebc6710e647c2536f2c811d7af83c76d5eda892fe21495932d7b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
ba769ab00897d4fb55dffd961262aca94281c6efccb3b806cc40b3c0bfa64fcb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
be7c09289a731533f9a2ca91d21b2f010905c445c8710ce84ae829cfe48d3343.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
c29b675475cb8428efab71268c98263fcbf9de29cfb64f21bf49b0a28c5982fe.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
fd5bd6afc507aad0acace57fc3b77a0de443e12efcdb3857d899395a962a3b4f.exe
Resource
win10v2004-20240508-en
General
-
Target
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe
-
Size
306KB
-
MD5
12247e55e50ac27c0e204010cb8a6ff2
-
SHA1
9bc069328ac9347cab83c6d6851635d81a2e830a
-
SHA256
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363
-
SHA512
6eb1536f155bdf040497c4801dfde22d45ddc5ea0f9d6961369d4b89d2c4cd8611747cc4759a7f02320a8d2ade593f01b853ddacf623b9beee4dd28b2c5e814c
-
SSDEEP
6144:47Zt9vSWh60RVAtljy11d4vOGvue6v5cltn32HxJyL98n:mZSWhHL4v7v53IzyL98n
Malware Config
Extracted
redline
5637482599
https://pastebin.com/raw/NgsUAPya
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral22/memory/1468-1-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exedescription pid process target process PID 1488 set thread context of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 8 1488 WerFault.exe f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
RegAsm.exepid process 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe 1468 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1468 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exedescription pid process target process PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe PID 1488 wrote to memory of 1468 1488 f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe"C:\Users\Admin\AppData\Local\Temp\f5875e99d264d6dc6b9a95473f93dd4b60f4562283d31642caef4eb5c5823363.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1488 -ip 14881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-8-0x0000000006120000-0x000000000615C000-memory.dmpFilesize
240KB
-
memory/1468-2-0x0000000074EEE000-0x0000000074EEF000-memory.dmpFilesize
4KB
-
memory/1468-9-0x00000000058B0000-0x00000000058FC000-memory.dmpFilesize
304KB
-
memory/1468-10-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/1468-4-0x0000000005900000-0x0000000005F18000-memory.dmpFilesize
6.1MB
-
memory/1468-5-0x0000000005300000-0x0000000005312000-memory.dmpFilesize
72KB
-
memory/1468-6-0x0000000005430000-0x000000000553A000-memory.dmpFilesize
1.0MB
-
memory/1468-7-0x0000000074EE0000-0x0000000075690000-memory.dmpFilesize
7.7MB
-
memory/1468-18-0x0000000074EE0000-0x0000000075690000-memory.dmpFilesize
7.7MB
-
memory/1468-1-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1468-3-0x0000000004DB0000-0x0000000004E16000-memory.dmpFilesize
408KB
-
memory/1468-11-0x0000000006B70000-0x000000000709C000-memory.dmpFilesize
5.2MB
-
memory/1468-12-0x0000000007650000-0x0000000007BF4000-memory.dmpFilesize
5.6MB
-
memory/1468-13-0x0000000006820000-0x00000000068B2000-memory.dmpFilesize
584KB
-
memory/1468-14-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/1468-15-0x0000000006710000-0x0000000006786000-memory.dmpFilesize
472KB
-
memory/1468-16-0x00000000066D0000-0x00000000066EE000-memory.dmpFilesize
120KB
-
memory/1488-0-0x0000000000858000-0x0000000000859000-memory.dmpFilesize
4KB