Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
Download.exe
Resource
win7-20240220-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Download.exe
Resource
win10v2004-20240704-en
5 signatures
150 seconds
General
-
Target
Download.exe
-
Size
361KB
-
MD5
6bcd18584fe4c7b0f2ac51354bc934d4
-
SHA1
268a296839768018adb777609e749ee7804c7e89
-
SHA256
0a9c29d37e942fda91b9129c15e6fed1c7e4395a5af820335e0e45f0f6fe9c7d
-
SHA512
77f00cc1d1affa01faf0594f202d056aeba5f81fde398da4b4a2d655ac4e6f3af68c23ee808a1e556217c41d0cabe5941246d0595851e5e2fa0c70cb6d34a633
-
SSDEEP
6144:ljffQ4RSLb8jqnW6JTJECTTSJeuxv4MZBx6aEsIQDmWAbSavR0t:1QlU2VlzT2J1A+BxWsIymWRa5S
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2444-16-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral1/memory/2444-14-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral1/memory/2444-11-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral1/memory/2444-8-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral1/memory/2444-7-0x0000000000400000-0x000000000044A000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2924 set thread context of 2444 2924 Download.exe 29 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2924 Download.exe Token: SeDebugPrivilege 2444 RegAsm.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29 PID 2924 wrote to memory of 2444 2924 Download.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Download.exe"C:\Users\Admin\AppData\Local\Temp\Download.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-