Overview
overview
10Static
static
7082abd50bc...72.exe
windows10-2004-x64
100a70b4612b...f6.exe
windows10-2004-x64
10136b546d35...01.exe
windows10-2004-x64
101ec8ce9ace...96.exe
windows10-2004-x64
1028e73a1086...9a.exe
windows7-x64
728e73a1086...9a.exe
windows10-2004-x64
73a5fd7dfde...92.exe
windows10-2004-x64
1056dbfb10e0...5d.exe
windows10-2004-x64
105f7c9e83d8...c5.exe
windows7-x64
35f7c9e83d8...c5.exe
windows10-2004-x64
10660944c2e2...12.exe
windows10-2004-x64
106b061fa476...e8.exe
windows10-2004-x64
10795a49ee81...4a.exe
windows10-2004-x64
107d1f6eeb31...ef.exe
windows10-2004-x64
1080f298c436...94.exe
windows10-2004-x64
1085555569bb...4d.exe
windows10-2004-x64
10bd2cad4003...26.exe
windows10-2004-x64
10c429566ed4...39.exe
windows10-2004-x64
10c47b15f967...7d.exe
windows10-2004-x64
10ce9f75c073...16.exe
windows10-2004-x64
10cfdc6cd562...d3.exe
windows10-2004-x64
10eb81f341bc...da.exe
windows10-2004-x64
10Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 13:14
Behavioral task
behavioral1
Sample
082abd50bc322e65df7b85b918d5bc248c652483544b6e4c453e9531969df172.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0a70b4612b5a8fdde3e7cb75dcc0caca23c46bd980d396bb52f7efc9d122c8f6.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
136b546d35913e21d69572f169ae203809c1521256619595aa6b15d763436c01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
1ec8ce9ace042665b07a0abc5b206634b1417b5f2a4a00b4554147d518832396.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
28e73a10869c3ce55af51de963cb8f48eac48b8f171602308b167d940e58899a.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
28e73a10869c3ce55af51de963cb8f48eac48b8f171602308b167d940e58899a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
3a5fd7dfdeb2d39f59735a8fd4f3621bef5a632886c19bfffeacac3350c44092.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
56dbfb10e07e622006233e2ca432e9b289e276470e18ab3efe037a1c17c40d5d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
660944c2e28e356790c36fcc99f1413b6daff34f154aeeda556c351fc695e812.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
6b061fa4768c28530459442828163e1c4cf33aa058cd0846566771b57ecf36e8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
795a49ee81e6eb25d2140b564c0aa63d165592e4d3b7bb4c29423c619b51334a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
7d1f6eeb31bd2e40692c777766b604a0bf50848518f5c931a53d7c48b988e8ef.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
85555569bb7d45d357512a0eafac484c22aee485efcb08f16f10d5cba19ad94d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
bd2cad400370a1839dedfee01ba51651868baedcef41cd34976bcfc1a2ccbf26.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c429566ed481fe562466b6e87d2cfe6fc492efeb3007819b63dd4cf45594d639.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
c47b15f9672b5795b62a389de76336302127184be510254d08b9b5100134dd7d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
ce9f75c073171b1315c869b550348e6d8c48a986b262a068b33f0833b7a24716.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
cfdc6cd562d69f4233d6d8bcde44d4bd5e6825bd17383e6bb2f76b9fd006ead3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
eb81f341bc6cd2678bd7559862571f5294b6980de5199672afa03b21de0a4dda.exe
Resource
win10v2004-20240426-en
General
-
Target
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe
-
Size
332KB
-
MD5
2a84ac6a70bf18fce3d4af2b04356f16
-
SHA1
4a9d0508a54994bac1ab3543be1c19ca80db0d9a
-
SHA256
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5
-
SHA512
554f6d13b08359b48fabedf051584c90975c1066c6dc01379f16ef360cb30bf11b13ca9a988242429a8bf7e3c25e7e405a18a5d2d844241f0850e49c7720d579
-
SSDEEP
6144:11Bwp/lwz9PI8/T6f5mUz7S3RMyghv1P9NKkY4WB4NSFUv1qcoH5+0Xp:1Pjz9PI8/Tzeyg91pY4WBJO1qcT0Xp
Malware Config
Extracted
redline
5345987420
https://pastebin.com/raw/NgsUAPya
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral10/memory/4764-2-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exedescription pid process target process PID 3204 set thread context of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
RegAsm.exepid process 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe 4764 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4764 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exedescription pid process target process PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe PID 3204 wrote to memory of 4764 3204 5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe"C:\Users\Admin\AppData\Local\Temp\5f7c9e83d80a652c6bde9ce18eaca08f9cb8a8012568629c5813a8e40f7e7ac5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3204-3-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/3204-1-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/3204-0-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/4764-10-0x0000000006860000-0x000000000689C000-memory.dmpFilesize
240KB
-
memory/4764-12-0x0000000006BE0000-0x0000000006DA2000-memory.dmpFilesize
1.8MB
-
memory/4764-5-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/4764-6-0x0000000006000000-0x0000000006618000-memory.dmpFilesize
6.1MB
-
memory/4764-7-0x0000000005A70000-0x0000000005A82000-memory.dmpFilesize
72KB
-
memory/4764-8-0x0000000005BA0000-0x0000000005CAA000-memory.dmpFilesize
1.0MB
-
memory/4764-9-0x00000000740D0000-0x0000000074880000-memory.dmpFilesize
7.7MB
-
memory/4764-2-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4764-11-0x00000000068A0000-0x00000000068EC000-memory.dmpFilesize
304KB
-
memory/4764-4-0x00000000740DE000-0x00000000740DF000-memory.dmpFilesize
4KB
-
memory/4764-13-0x00000000072E0000-0x000000000780C000-memory.dmpFilesize
5.2MB
-
memory/4764-14-0x0000000007DC0000-0x0000000008364000-memory.dmpFilesize
5.6MB
-
memory/4764-15-0x0000000006DB0000-0x0000000006E42000-memory.dmpFilesize
584KB
-
memory/4764-16-0x0000000006E50000-0x0000000006EA0000-memory.dmpFilesize
320KB
-
memory/4764-17-0x0000000006EA0000-0x0000000006F16000-memory.dmpFilesize
472KB
-
memory/4764-18-0x0000000006BB0000-0x0000000006BCE000-memory.dmpFilesize
120KB
-
memory/4764-20-0x00000000740D0000-0x0000000074880000-memory.dmpFilesize
7.7MB