Analysis
-
max time kernel
135s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 18:32
Static task
static1
Behavioral task
behavioral1
Sample
Download.exe
Resource
win7-20240220-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Download.exe
Resource
win10v2004-20240704-en
5 signatures
150 seconds
General
-
Target
Download.exe
-
Size
361KB
-
MD5
6bcd18584fe4c7b0f2ac51354bc934d4
-
SHA1
268a296839768018adb777609e749ee7804c7e89
-
SHA256
0a9c29d37e942fda91b9129c15e6fed1c7e4395a5af820335e0e45f0f6fe9c7d
-
SHA512
77f00cc1d1affa01faf0594f202d056aeba5f81fde398da4b4a2d655ac4e6f3af68c23ee808a1e556217c41d0cabe5941246d0595851e5e2fa0c70cb6d34a633
-
SSDEEP
6144:ljffQ4RSLb8jqnW6JTJECTTSJeuxv4MZBx6aEsIQDmWAbSavR0t:1QlU2VlzT2J1A+BxWsIymWRa5S
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3936-4-0x0000000000400000-0x000000000044A000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2172 set thread context of 3936 2172 Download.exe 86 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2172 Download.exe Token: SeDebugPrivilege 3936 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86 PID 2172 wrote to memory of 3936 2172 Download.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Download.exe"C:\Users\Admin\AppData\Local\Temp\Download.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3936
-