Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
-
Size
684KB
-
MD5
f72116320be7db9c40758491789700fb
-
SHA1
8d8e9db2ea63b4f1dc0ef694135571003d2e3b08
-
SHA256
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f
-
SHA512
b9c6b95628b4323e03f57fb41ece3ddf33c2c1cba24dfb4c4b2563bbacebdaaf5dfa080b22fd9f45bfd3ed0ae19f3274b21530fddc82a310549cc094873bced4
-
SSDEEP
12288:z2O1vhGM8K82VweO4v9kUl4xV5M/rLc3mzwQaYHG5cb/DS8okN:zXvob8OUlzrY3mYYHnDD1ok
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3336-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 536 set thread context of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe 3336 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeBackupPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe Token: SeSecurityPrivilege 3336 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 536 wrote to memory of 3336 536 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe"C:\Users\Admin\AppData\Local\Temp\0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-