Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe
-
Size
707KB
-
MD5
4004702b34db686e3b15959ec3a6b29d
-
SHA1
226e055d3658d44ea3669a838cc09065b1092d11
-
SHA256
c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf
-
SHA512
9c3f8e9301557d979cc18cc465812718a84b36dd0142fda37c1f41f68639fb9c326ac20661d0ae73b0ad698bec04420367daf0606acec5f193ae7c32e28bf1f4
-
SSDEEP
12288:qg7AIDQUi3MT8RcnVVaT3xXnNh634UbKxzX+5dhdaA6TG4eKZ5G7VLvoF:qKBDQr3u8G+TBXnNi47xr+5dhdaAGGjo
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/944-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2208 set thread context of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe 944 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeBackupPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe Token: SeSecurityPrivilege 944 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89 PID 2208 wrote to memory of 944 2208 c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe"C:\Users\Admin\AppData\Local\Temp\c78bbbf507b859caee051a6a141b5fdcd1bf69eef25a07d64d4a1969bc744caf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
-