Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2024 17:19
Behavioral task
behavioral1
Sample
7186BCE1F86503FE86E67C46DEFD400A.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7186BCE1F86503FE86E67C46DEFD400A.exe
Resource
win10v2004-20241007-en
General
-
Target
7186BCE1F86503FE86E67C46DEFD400A.exe
-
Size
275KB
-
MD5
7186bce1f86503fe86e67c46defd400a
-
SHA1
737eb7becd01fd21b9db5c94e6fb20c9ba4dd960
-
SHA256
1aeec278d38b426366a13214ce235f939c5f8cefc5cd3745408459d032edd07a
-
SHA512
897ec3536dfc6e20718af45d327798d32205ea565be8b2ec4fa502424a833d5fcbd542b924ebd2983d117e3049627e8bc320f65c78b1617a97ee58096943496c
-
SSDEEP
6144:9Zcv3sAZP9zvkkfgd8CqeD8BNAp0h01pGl:9+vjPZ0d83eINAp0R
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3460-1-0x0000000000BA0000-0x0000000000BEA000-memory.dmp family_redline -
Redline family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7186BCE1F86503FE86E67C46DEFD400A.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe 3460 7186BCE1F86503FE86E67C46DEFD400A.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeBackupPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe Token: SeSecurityPrivilege 3460 7186BCE1F86503FE86E67C46DEFD400A.exe