Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 17:19
Behavioral task
behavioral1
Sample
7186BCE1F86503FE86E67C46DEFD400A.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7186BCE1F86503FE86E67C46DEFD400A.exe
Resource
win10v2004-20241007-en
General
-
Target
7186BCE1F86503FE86E67C46DEFD400A.exe
-
Size
275KB
-
MD5
7186bce1f86503fe86e67c46defd400a
-
SHA1
737eb7becd01fd21b9db5c94e6fb20c9ba4dd960
-
SHA256
1aeec278d38b426366a13214ce235f939c5f8cefc5cd3745408459d032edd07a
-
SHA512
897ec3536dfc6e20718af45d327798d32205ea565be8b2ec4fa502424a833d5fcbd542b924ebd2983d117e3049627e8bc320f65c78b1617a97ee58096943496c
-
SSDEEP
6144:9Zcv3sAZP9zvkkfgd8CqeD8BNAp0h01pGl:9+vjPZ0d83eINAp0R
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/1580-1-0x0000000001100000-0x000000000114A000-memory.dmp family_redline -
Redline family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7186BCE1F86503FE86E67C46DEFD400A.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe 1580 7186BCE1F86503FE86E67C46DEFD400A.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeBackupPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 1580 7186BCE1F86503FE86E67C46DEFD400A.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b