Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/07/2024, 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe
-
Size
684KB
-
MD5
f72116320be7db9c40758491789700fb
-
SHA1
8d8e9db2ea63b4f1dc0ef694135571003d2e3b08
-
SHA256
0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f
-
SHA512
b9c6b95628b4323e03f57fb41ece3ddf33c2c1cba24dfb4c4b2563bbacebdaaf5dfa080b22fd9f45bfd3ed0ae19f3274b21530fddc82a310549cc094873bced4
-
SSDEEP
12288:z2O1vhGM8K82VweO4v9kUl4xV5M/rLc3mzwQaYHG5cb/DS8okN:zXvob8OUlzrY3mYYHnDD1ok
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4580-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 940 set thread context of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe 4580 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeBackupPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe Token: SeSecurityPrivilege 4580 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 940 wrote to memory of 4384 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 83 PID 940 wrote to memory of 4384 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 83 PID 940 wrote to memory of 4384 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 83 PID 940 wrote to memory of 1036 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 84 PID 940 wrote to memory of 1036 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 84 PID 940 wrote to memory of 1036 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 84 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85 PID 940 wrote to memory of 4580 940 0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe"C:\Users\Admin\AppData\Local\Temp\0c0103b124e6832239844096bae291549b4d69b8b026d0ac782b2a7146049d8f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4384
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1036
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
-