redline | 62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03

General

Target

62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe
Size

707KB
MD5

11954e7a5d702f344150208416308812
SHA1

ec9cfa7c45dfe1f838dab5aad44283e861cdab75
SHA256

62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03
SHA512

d841be0f780dbb12b09731b030124449b7c21de1e1ad3f22cf9b893a0e382cd23f60cc2fa92ed35051bb2d040380acc988c585ed81d6f4e8b1c51ba80f782f57
SSDEEP

12288:Lg7AIDQUiccB5VwHgtOvy1tvkBp+s0kqARkEvx4b3SIhdH8nZtaLSqkqJH:LKBDQrcYdtOvy1t8b+VkqARkEvx4Fgnq

Score

10^/10

redline discovery infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5076-0-0x0000000000400000-0x0000000000484000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe

description	pid	process	target process
PID 4860 set thread context of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exeRegAsm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RegAsm.exe

pid	process
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe
5076	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeBackupPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe
Token: SeSecurityPrivilege	5076	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe

description	pid	process	target process
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe
PID 4860 wrote to memory of 5076	4860	62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe
"C:\Users\Admin\AppData\Local\Temp\62020510c2c5371187e240cb5e0c2a190af2f26b394d862f84d9153b35ed7a03.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-1-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/5076-0-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5076-2-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/5076-3-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/5076-4-0x00000000054B0000-0x00000000054D0000-memory.dmp

Filesize
128KB

Download
memory/5076-5-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/5076-6-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/5076-7-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/5076-8-0x0000000008920000-0x0000000008F38000-memory.dmp

Filesize
6.1MB

Download
memory/5076-9-0x0000000008470000-0x000000000857A000-memory.dmp

Filesize
1.0MB

Download
memory/5076-10-0x00000000083B0000-0x00000000083C2000-memory.dmp

Filesize
72KB

Download
memory/5076-11-0x0000000008410000-0x000000000844C000-memory.dmp

Filesize
240KB

Download
memory/5076-12-0x0000000008580000-0x00000000085CC000-memory.dmp

Filesize
304KB

Download
memory/5076-13-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/5076-14-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads