Overview
overview
10Static
static
306f3c929ba...53.exe
windows10-2004-x64
10122d65cff9...20.exe
windows10-2004-x64
101a0bfd97a4...9c.exe
windows10-2004-x64
101a180e9105...fe.exe
windows10-2004-x64
101c5289e7e6...0b.exe
windows10-2004-x64
1032ca200f34...aa.exe
windows10-2004-x64
103aa025ea78...5d.exe
windows10-2004-x64
103bcf19ad48...5c.exe
windows10-2004-x64
106b10f19a8c...42.exe
windows10-2004-x64
108b1c0f6d0e...f8.exe
windows10-2004-x64
109270cb48ef...96.exe
windows10-2004-x64
10982c3849f2...2b.exe
windows10-2004-x64
10a5ef532105...7b.exe
windows10-2004-x64
10a96e6df3c0...de.exe
windows10-2004-x64
10ba6bca4989...71.exe
windows10-2004-x64
10bad97858db...8e.exe
windows10-2004-x64
10bcce7883f8...a7.exe
windows7-x64
10bcce7883f8...a7.exe
windows10-2004-x64
10cfb7a03bea...b3.exe
windows10-2004-x64
10f446c909f1...3f.exe
windows10-2004-x64
10f8f22cd34c...16.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 19:04
Static task
static1
Behavioral task
behavioral1
Sample
06f3c929bab6bc6923c8d8bcc94bb40374b50fbcd1c5bb74105608664f303c53.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
122d65cff91cdb1f9a418aade39cb9c3809ca653f37aff626317f9d139f10a20.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1a0bfd97a460f55b1fc7e0dce89496b0041a7a6e39a4429ca0e9d48b03a50c9c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
1a180e910531bba2f707949af207f2fdc8ce9073f7ac314168ae29b53eedd8fe.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
1c5289e7e618b13af020062e6a741d58a9f93e862fe8f04fa08d33b6e2ace50b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
32ca200f348780ce8d89e1c2b2a59df856ec7ce7657e7807dc4330e092222baa.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
3aa025ea78f4c4f22121974ca9750d5a185b237e08bdbb6226487f9b7182e85d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
3bcf19ad48db781a2c873e68aa933f623915c3a94ae76b3b8bb367d1d4b90e5c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
6b10f19a8c69f2455a53b070f335d6251772e99efec94e5ada48b7464cae5a42.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
8b1c0f6d0e624fbcd937c3ccc23b673ab7072ccc0339934effd7d6d64916b2f8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
9270cb48ef49ae030430c2bd7e18a87fbd6d168cbe4d15f9e272f075b605d296.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
982c3849f2e88644dd45e489219e2fa85fc8e40c0842ae8fbd06b1bdf7d2382b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
a5ef5321052ab836215111e00811fcd41cd3e3b3786bda1ed7edece97cba6a7b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
a96e6df3c0e345fa518723f36c81521d2f056b19754c4bbd84cdd3c90347eede.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
bad97858db5dda89342aa20cee6db489fa0f6859c8723e24cac79ffb85811e8e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
cfb7a03beaf7d7fc86e7d64b823645be27b3ae8e9fada6e93ba232a6916307b3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
f446c909f19842f14d9643227c64f29a129aefa05bfd1800cdf1d9231454083f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
f8f22cd34cb4e25f9de8ac7d851976b70c81c9f756ba7be65cd8408823b8e916.exe
Resource
win10v2004-20240426-en
General
-
Target
bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe
-
Size
1.1MB
-
MD5
70cfabed1c042d1256b7a9d3c54366ca
-
SHA1
e8fb44daf242175fba34d583533a1b60a4ccaf31
-
SHA256
bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7
-
SHA512
b5db1d0488fb60229f5cc9478c7187e81353336cdae3d0efc28d1582abf3982c62ef105bc8903bf2cb046946abe9aecc8c5bed49c32b7b925f14c8bd9f8957bb
-
SSDEEP
12288:sLezkH3T4U+zNJUWcaQ57xBOgzm7E9vvlM0snyWzhYHVh95zRiwkH6fuDM8ef6GV:slX1+zNvcaQ57x9Gml5h9xRicCYt4MD
Malware Config
Extracted
redline
@youngesstt
94.142.138.4:80
-
auth_value
71ec3d0d54996f30b1d94c74838b6940
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral18/memory/3456-1-0x0000000000400000-0x0000000000430000-memory.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2360 set thread context of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84 PID 2360 wrote to memory of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84 PID 2360 wrote to memory of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84 PID 2360 wrote to memory of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84 PID 2360 wrote to memory of 3456 2360 bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe"C:\Users\Admin\AppData\Local\Temp\bcce7883f84c054a7e0e31d30fae77ecd28c2dc7149f36958b01440bf0334ea7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:3456
-