Analysis
-
max time kernel
22s -
max time network
21s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
07-07-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win11-20240508-en
General
-
Target
main.exe
-
Size
482KB
-
MD5
a8f7b3983a78d7d80e23f611b6abdcee
-
SHA1
a7ad42f1777735581e1adeadefcdfd45c4d92162
-
SHA256
6bc77deea74bc979a027e31d1a3afb594417c8fc366626f538b64a26d6f29fff
-
SHA512
5af20833a07fd610d0f70ca92b8687415b9ed7bd9b8c1c1b2c9d959da73bb085122295e3ba1d7a0a36d14aa8264b95262f66fcc22f4ea18384645768834e5830
-
SSDEEP
12288:m5V2qPu7Ja0ApqVhnKrJAJIwjZfnhBr1klpbIoWSiwPm5sb9OGu46HDsKQefaur+:tqPuU1x
Malware Config
Extracted
redline
@nmrzv88
94.228.166.68:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2608-8-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
pid Process 2556 main.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2556 set thread context of 2608 2556 main.exe 78 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78 PID 2556 wrote to memory of 2608 2556 main.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2608
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437KB
MD5ac5eeb006d2b590f66ae7e69174d5f3a
SHA12331f0fc6f14c8bbd6a176927af84f95a946a638
SHA2569af40752470f3a82a4bb166558f0f5492269a30402458cf11af084f841cb4c49
SHA5124aff61122e0a1ebd25bd73fc9aea3272b82cb544310e243d4396c6cf9246d4b9d808e523b1a34e38ad5c41a04a6e4a6333eb62cef6d85ba5562bb36593fff443