Overview
overview
10Static
static
3131b47af99...32.exe
windows10-2004-x64
10227ab56ef5...eb.exe
windows10-2004-x64
104537f51b0d...4c.exe
windows10-2004-x64
104852dcede8...5b.exe
windows7-x64
104852dcede8...5b.exe
windows10-2004-x64
104d68d381e4...34.exe
windows10-2004-x64
1062d27d23e1...d0.exe
windows10-2004-x64
106f4e5c3b3a...2b.exe
windows10-2004-x64
10775b7a0479...3d.exe
windows10-2004-x64
1080a8dab579...f7.exe
windows10-2004-x64
10a28852a355...af.exe
windows10-2004-x64
7d02a87f385...3a.exe
windows10-2004-x64
10d0c1074be1...1f.exe
windows10-2004-x64
10d427832084...e1.exe
windows10-2004-x64
10d53f5a64de...d1.exe
windows10-2004-x64
10d62198c81d...0d.exe
windows10-2004-x64
10dd0f820c33...a3.exe
windows10-2004-x64
10e3c377dc6b...f7.exe
windows10-2004-x64
10e9172c1691...86.exe
windows10-2004-x64
10f6c86e8cbc...da.exe
windows10-2004-x64
10fbd8d72f7e...0c.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
131b47af993204905e6dd4dd4ff06b43cb1a0fe2e2b140520d4962f73d4b6432.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral5
Sample
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
4d68d381e45f27176b76095693f986c42472611f4598e13b214a1c40acc89834.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
62d27d23e1f8603e95173890b3a03815aecbbbba3cc357aa36aba1f8374397d0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
775b7a04793f8621742cc362f51bef7b4d75b10169fa3493b7c9f713d38fa73d.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
80a8dab5792d1a02e87ec84b22f15eb4bbac6d7635c605250fb1379296e8ccf7.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
a28852a355422f5e5dba04ddfb954e654687e210441a284402775d3dbb8392af.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
d02a87f385dee50b4399336265bbf8fe7f692201914bcb50c64ca95a35707f3a.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
d0c1074be1d3cb22682be7bb947cb39668cb342942917997126020b102ea101f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d53f5a64de740270c801f8951781be9743b4ec40b8b353271cb0cbf0a4c8b8d1.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
d62198c81df0ae252c179f6cb6041efd2bb2aea225a387a06ee457bcd7d5930d.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
dd0f820c33b1cedd17049cf9b5cc18637676e9aa3cfaadbd8f19144e345b7da3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
e3c377dc6b3cceb0b4ae2fa0504de53fe1dad61a6bb656af0994220dfea6bdf7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
e9172c16918ce5309dd65e1af444189e955a30b3ccec8e619cf23b147ebfb586.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
f6c86e8cbc27556d873bb54eaa4778cf8529fe90df5c8b3070e8ed040254afda.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
fbd8d72f7e8046c650efa73c6d984945abfe9952bd8f67360b4658fc5138e70c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe
-
Size
376KB
-
MD5
d31797dc0f17f69e5245e0a452aab2b3
-
SHA1
9bd1e6981d8cde9f7db98540711101cd57ead02c
-
SHA256
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b
-
SHA512
7de1f6f6b7354e684e0850fe3149253cddb01dfe9e7aa692c100e52f62ce5875a73d051a5f90c2a58fb78ea17c4fb46f706ae55c5afb694cf2315370230985f2
-
SSDEEP
6144:V93K5fykNFVr5ywuibFEr3dyYAOI/CsqfCJijYXF7Z/2wk6CJOn0ttp:V9a5frbVr5ujxu7qfPjZT
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral4/memory/2680-5-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/2680-3-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/2680-2-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/2680-9-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/2680-7-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1688 set thread context of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 2472 1688 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2900 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 28 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2680 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 29 PID 1688 wrote to memory of 2472 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 30 PID 1688 wrote to memory of 2472 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 30 PID 1688 wrote to memory of 2472 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 30 PID 1688 wrote to memory of 2472 1688 4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe"C:\Users\Admin\AppData\Local\Temp\4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2900
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 1442⤵
- Program crash
PID:2472
-