redline | a44d7397ca2486a37cfbc6cd473037b204a5fe4678303dd2f187c814c85f25db

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe
Size

332KB
MD5

7309fca9a6af6decce73c4243a826af5
SHA1

4567ebd86d7c877db55588520569c8b23ddc9ac0
SHA256

65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95
SHA512

312d47fc63601fde26ccc563c3a3999528f9ef19d75a63b91be38d45e4ad77302fd31593bdccd25aa8bdc6e915e6de820c1b1914c0d0be249ffcfa160e73272f
SSDEEP

6144:K+v1KlJPEF7c4i/93KJ7JN7Zi8A0GbkthVuP90EjKjrOjL7:oPEF7g4JO8AVk7VuFZWrOj

Score

10^/10

redline 5728088920 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

5728088920

https://pastebin.com/raw/NgsUAPya

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral5/memory/5080-2-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	pastebin.com
14	pastebin.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4188 set thread context of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe
5080	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91
PID 4188 wrote to memory of 5080	4188	65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe	91

C:\Users\Admin\AppData\Local\Temp\65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe
"C:\Users\Admin\AppData\Local\Temp\65296f468099ebcd60c98ae5a6f7f005a227427a05eda0790e32e2f0c0061d95.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4188-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/4188-1-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/4188-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/5080-6-0x0000000005A00000-0x0000000006018000-memory.dmp

Filesize
6.1MB

Download
memory/5080-4-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/5080-5-0x0000000004EB0000-0x0000000004F16000-memory.dmp

Filesize
408KB

Download
memory/5080-2-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5080-7-0x0000000005470000-0x0000000005482000-memory.dmp

Filesize
72KB

Download
memory/5080-8-0x00000000055A0000-0x00000000056AA000-memory.dmp

Filesize
1.0MB

Download
memory/5080-9-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/5080-10-0x0000000006260000-0x000000000629C000-memory.dmp

Filesize
240KB

Download
memory/5080-11-0x00000000062A0000-0x00000000062EC000-memory.dmp

Filesize
304KB

Download
memory/5080-12-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/5080-13-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download