Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/07/2024, 07:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe
-
Size
707KB
-
MD5
999755d3fffe69efda3aea8e7e6ab949
-
SHA1
07426fb76ea276fbe18e7912aa7768bdc291801d
-
SHA256
95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32
-
SHA512
bae3491dac1787689975b832060c2e49f2d1cb0376f2cf9aa533d14072e5cd9f802ff8e73da058d53e820c5b7920ec689af4cf7782f3df3dc166aaa89b71995f
-
SSDEEP
12288:vplZ+ID1nqE3BFiXQF0/YvrN5Gjhkl+jzi3MSKRWG+aPyEe28F+mstS6+O07W2au:vLZ3D1qE3biXTAN5G1kl+jzifKRWG3c1
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/684-0-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1868 set thread context of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe 684 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeBackupPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe Token: SeSecurityPrivilege 684 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83 PID 1868 wrote to memory of 684 1868 95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe"C:\Users\Admin\AppData\Local\Temp\95600ecbe2f43a416be103d04bd718b512023cc31b7b3153a836cb9d5066fb32.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684
-