Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
-
Size
707KB
-
MD5
f2c4eeb3704eb32209482f611075ed81
-
SHA1
c7bc15a8548b466bab08f6fa5fefde3cc98c19eb
-
SHA256
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e
-
SHA512
d472bcb931970cf378561ed63d6963555aead47bc7677ef7ef48976bcaf5aa34fcf625a9ee293922bfe402e0593bd2d1df0d0799fa1d9f18e771e505e90c53e3
-
SSDEEP
12288:9g7AIDQUi3cKcdxUAcdMpbi8jqSNErbzwlpIam9JuGJ1wmo8ZnTHgK:9KBDQr3cKckMbiEtNIbzQpIl9Jp1wmoG
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3292-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2296 set thread context of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe 3292 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeBackupPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe Token: SeSecurityPrivilege 3292 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3032 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 89 PID 2296 wrote to memory of 3032 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 89 PID 2296 wrote to memory of 3032 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 89 PID 2296 wrote to memory of 4412 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 90 PID 2296 wrote to memory of 4412 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 90 PID 2296 wrote to memory of 4412 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 90 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91 PID 2296 wrote to memory of 3292 2296 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe"C:\Users\Admin\AppData\Local\Temp\dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3032
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4412
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
-