Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/07/2024, 02:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe
-
Size
707KB
-
MD5
f63cad6f15c7ec9444375d81fea89f49
-
SHA1
e7b7709c4c0cc73ca6e7ead1ad875c34666e05b5
-
SHA256
b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7
-
SHA512
081a56f774e738e470cc0bb1ea402a609cb1b175bcf86acda5ba648d34f86c0ff769e7be60ecc4354bcfc37f71d1fc0590354fb424162ebb76a09c07cfbea001
-
SSDEEP
12288:2g7AIDQUictO1Pq4qcODjRf42aD1VZ3XQ7ndUIx3Z56JCu2zVFPBh2Sq:2KBDQrct83q/AVD1VFgzbx3nqIzSSq
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4820-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2444 set thread context of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe 4820 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeBackupPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe Token: SeSecurityPrivilege 4820 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83 PID 2444 wrote to memory of 4820 2444 b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe"C:\Users\Admin\AppData\Local\Temp\b62f335694473bb3fe963257e1f44990a0f3ab1c3cdce5303818e3a02af6e7e7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-