Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 01:18
Behavioral task
behavioral1
Sample
5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe
-
Size
401KB
-
MD5
1e53aeaabcab0989b473e44f7ef02731
-
SHA1
85b2a41e8060a08eff4a1fc97e078229ee1e781d
-
SHA256
5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2
-
SHA512
a74380c04dd5f49f13074a3d14be3bfd4b213c970604d70ed42591b4ba14841dd248a4c48adcc64ecf19ffdb4aa50285a05e3cfee4a20f1e3f159b8241a4a8bc
-
SSDEEP
6144:cCLCDJ0p8LXxb/cMnz19/Fx+qQDkgCxsmjDQnIKp+59Ff+++++h++EuFF++CvF:cIaK8LXt/cMnzHjbQ4vx7Qn4EmF
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/2268-1-0x0000000001120000-0x000000000118A000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeBackupPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe Token: SeSecurityPrivilege 2268 5be89599ac45c88bad9083afcc555874c94bd711a44c67e5d0aad0ab318188c2.exe