Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-07-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe
-
Size
707KB
-
MD5
f2c4eeb3704eb32209482f611075ed81
-
SHA1
c7bc15a8548b466bab08f6fa5fefde3cc98c19eb
-
SHA256
dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e
-
SHA512
d472bcb931970cf378561ed63d6963555aead47bc7677ef7ef48976bcaf5aa34fcf625a9ee293922bfe402e0593bd2d1df0d0799fa1d9f18e771e505e90c53e3
-
SSDEEP
12288:9g7AIDQUi3cKcdxUAcdMpbi8jqSNErbzwlpIam9JuGJ1wmo8ZnTHgK:9KBDQr3cKckMbiEtNIbzQpIl9Jp1wmoG
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/1736-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4792 set thread context of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe 1736 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeBackupPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe Token: SeSecurityPrivilege 1736 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83 PID 4792 wrote to memory of 1736 4792 dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe"C:\Users\Admin\AppData\Local\Temp\dc380c2d30ad3438dea7fed94119f3f8e05a45f42fc952525cc631ffa5d67c7e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
-