Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 17:36
Static task
static1
Behavioral task
behavioral1
Sample
46102e5be024379e54fa1b988aa54582.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
46102e5be024379e54fa1b988aa54582.exe
Resource
win10v2004-20240508-en
General
-
Target
46102e5be024379e54fa1b988aa54582.exe
-
Size
339KB
-
MD5
46102e5be024379e54fa1b988aa54582
-
SHA1
e1475f61eacde61979c7e8b0203b5a0ac6b14dfe
-
SHA256
7e4d553a0d48c82c4d0dca1a58ae34f86d5683200c174b39d9b1f56ccb050075
-
SHA512
7e4ee549c56cc473f296a45e68a7519f827c503cffc59612d19d67858c42618ca8f0a74c02db2ab0ce78c9e6075c4ca33096dd976febea3f994e92c42f5f6576
-
SSDEEP
6144:I5zGmvtRypYPkT/lGc7bJo8L+HIXnXmeQV9CSug:0GsAphtbJIHI3yASug
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/2504-4-0x00000000045C0000-0x00000000045F4000-memory.dmp family_redline behavioral1/memory/2504-5-0x0000000004600000-0x0000000004632000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2504 46102e5be024379e54fa1b988aa54582.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe Token: SeBackupPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe Token: SeSecurityPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe Token: SeSecurityPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe Token: SeSecurityPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe Token: SeSecurityPrivilege 2504 46102e5be024379e54fa1b988aa54582.exe