Overview
overview
10Static
static
3000643ece0...88.exe
windows10-2004-x64
100e413fa969...3c.exe
windows10-2004-x64
10123830f5ad...0f.exe
windows10-2004-x64
10189bf8b11d...e3.exe
windows10-2004-x64
1030781e91d6...0c.exe
windows7-x64
330781e91d6...0c.exe
windows10-2004-x64
104312b77e60...ce.exe
windows10-2004-x64
1055a2613b91...ce.exe
windows10-2004-x64
1057e17d171c...0b.exe
windows10-2004-x64
10604b676155...8c.exe
windows10-2004-x64
10617783538b...1f.exe
windows10-2004-x64
10729187837b...ea.exe
windows10-2004-x64
10747238b5bd...97.exe
windows10-2004-x64
107ec0dcfd62...a1.exe
windows7-x64
37ec0dcfd62...a1.exe
windows10-2004-x64
108468f46bfb...d1.exe
windows10-2004-x64
108e6dae5587...22.exe
windows10-2004-x64
109966ddcefb...d8.exe
windows10-2004-x64
10b7dd4fa2a0...d9.exe
windows7-x64
3b7dd4fa2a0...d9.exe
windows10-2004-x64
10dd86e508d3...d9.exe
windows10-2004-x64
7e500bee084...71.exe
windows10-2004-x64
10ff54e8ca62...50.exe
windows10-2004-x64
10Analysis
-
max time kernel
91s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 14:32
Static task
static1
Behavioral task
behavioral1
Sample
000643ece079f96ed416c42e9dec2e3a647599f99950c60349c52e36cb724e88.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
0e413fa9690c02a45dc95f1ea020874ed2745670117fed803aea439be9b8683c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
123830f5adc2114333a361b752e02a6ae770080082ba2b79c984aaf2debf810f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
189bf8b11dee99ed7e1e469dc473e6a36cc501c81db6093fdae6c031c37139e3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
30781e91d68861344f162ee5566cedc2c3c10246b4ec0c14b8f23cffe8bc9c0c.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
30781e91d68861344f162ee5566cedc2c3c10246b4ec0c14b8f23cffe8bc9c0c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
4312b77e6031b30312b6c5c30180fca1895d4c065914103fa2e4ca9e8da9a0ce.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
55a2613b9117beb668b5eda94de72151952cc566a09c80460e6169cfe1e7edce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
57e17d171cef6609925870e83612ab3f4cb883b2bac745d2a500d5e839fada0b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
604b676155ad58fa6826907866dfba9510268d91c3cbfa0df8706492c47c0f8c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
617783538bdab4bd7c8fbacae9e8749b50cd02e596dc328612ea1d600c11dc1f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
729187837b6282872fd853df135ab03458edda808d089983498f29a635b978ea.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
747238b5bd007fbf264cbd66b42a3fa3d6c54ccb6a1d0ce2c79715650a55d097.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
7ec0dcfd6246ae153473783715a6fcdc5d5b76379404002057ad04b8746c7aa1.exe
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
7ec0dcfd6246ae153473783715a6fcdc5d5b76379404002057ad04b8746c7aa1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
8468f46bfbde3077ec27b4d06b0b5617a8dec77c7537ca26f5b248d5def7dad1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
8e6dae5587d0150e1fa568f6ff42d2f6790750c017c08f86cff2c14b18de7422.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
9966ddcefba77b1337606836fd7507a61fc0f6488163d75c6c426d9c488139d8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
dd86e508d33a5b71e82ab1b41a8dd7c49009ac65ba2191c467d7c58267e8ead9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
e500bee084b2757ef23283d465255eeb1eed61d9ed67171a24f814de66cf3b71.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
ff54e8ca62b5d37f515d9883b629f0761bba9e583cfd91abda232bc4e5b5cd50.exe
Resource
win10v2004-20240426-en
General
-
Target
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe
-
Size
293KB
-
MD5
3503d07ffdcbf58c0991a126f62e2c5c
-
SHA1
3ed929e6f39d6088a58f34f960a7c990b390675a
-
SHA256
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9
-
SHA512
12dd40424a7b70721f7a631220862126a12f5812f95e121eeff76b23b147020a98100cb152082dffb7a68cae5015c5392775264a754b3e6931099beb26c52157
-
SSDEEP
6144:27wlKAtETWV0M582YRT/9pWIYjkSbGwRm/CN+wbsdSaaO0:iAtETWV7uXpRYjk4BRFNzwdAO0
Malware Config
Extracted
redline
5195552529
https://pastebin.com/raw/NgsUAPya
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral20/memory/2312-1-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exedescription pid process target process PID 3628 set thread context of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
RegAsm.exepid process 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe 2312 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 2312 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exedescription pid process target process PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe PID 3628 wrote to memory of 2312 3628 b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe"C:\Users\Admin\AppData\Local\Temp\b7dd4fa2a0deaf6b70cea7aaf1292a2e835aef45edb5a190cc515d98cf60a8d9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2312-8-0x0000000006490000-0x00000000064CC000-memory.dmpFilesize
240KB
-
memory/2312-2-0x0000000074E5E000-0x0000000074E5F000-memory.dmpFilesize
4KB
-
memory/2312-9-0x00000000064D0000-0x000000000651C000-memory.dmpFilesize
304KB
-
memory/2312-10-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/2312-4-0x0000000005C20000-0x0000000006238000-memory.dmpFilesize
6.1MB
-
memory/2312-5-0x00000000056A0000-0x00000000056B2000-memory.dmpFilesize
72KB
-
memory/2312-6-0x00000000057D0000-0x00000000058DA000-memory.dmpFilesize
1.0MB
-
memory/2312-7-0x0000000074E50000-0x0000000075600000-memory.dmpFilesize
7.7MB
-
memory/2312-18-0x0000000074E50000-0x0000000075600000-memory.dmpFilesize
7.7MB
-
memory/2312-1-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2312-3-0x0000000005100000-0x0000000005166000-memory.dmpFilesize
408KB
-
memory/2312-11-0x0000000006F10000-0x000000000743C000-memory.dmpFilesize
5.2MB
-
memory/2312-12-0x00000000069E0000-0x0000000006A72000-memory.dmpFilesize
584KB
-
memory/2312-13-0x00000000079F0000-0x0000000007F94000-memory.dmpFilesize
5.6MB
-
memory/2312-14-0x0000000006A80000-0x0000000006AD0000-memory.dmpFilesize
320KB
-
memory/2312-15-0x0000000006B50000-0x0000000006BC6000-memory.dmpFilesize
472KB
-
memory/2312-16-0x0000000006AF0000-0x0000000006B0E000-memory.dmpFilesize
120KB
-
memory/3628-0-0x0000000000948000-0x000000000094A000-memory.dmpFilesize
8KB