Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 23:22

General

  • Target

    Panel/RedLine20_22/Panel/Panel.exe

  • Size

    9.3MB

  • MD5

    f4e19b67ef27af1434151a512860574e

  • SHA1

    56304fc2729974124341e697f3b21c84a8dd242a

  • SHA256

    c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a

  • SHA512

    a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77

  • SSDEEP

    196608:mJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHidVI1SM52n3iWuUZ/c1sxXoP3p:mJQaPHrQqXs140qMhu8369sV+HLz9SKI

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Redline family
  • Suspicious use of NtSetInformationThreadHideFromDebugger 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe
    "C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe
      "C:\Users\Admin\AppData\Local\Temp\Panel\RedLine20_22\Panel\Panel.exe" "--monitor"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2924-80-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-3981-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-28-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-1-0x000007FEF5983000-0x000007FEF5984000-memory.dmp

    Filesize

    4KB

  • memory/2924-21-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/2924-18-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/2924-15-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/2924-13-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/2924-4-0x000000001B2C0000-0x000000001B460000-memory.dmp

    Filesize

    1.6MB

  • memory/2924-3-0x000000001B2C0000-0x000000001B460000-memory.dmp

    Filesize

    1.6MB

  • memory/2924-2-0x000000001B2C0000-0x000000001B460000-memory.dmp

    Filesize

    1.6MB

  • memory/2924-47-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-45-0x000000001E270000-0x000000001E3B2000-memory.dmp

    Filesize

    1.3MB

  • memory/2924-37-0x000000001E120000-0x000000001E262000-memory.dmp

    Filesize

    1.3MB

  • memory/2924-31-0x000000001E120000-0x000000001E262000-memory.dmp

    Filesize

    1.3MB

  • memory/2924-29-0x000000001E120000-0x000000001E262000-memory.dmp

    Filesize

    1.3MB

  • memory/2924-73-0x000000001DE60000-0x000000001DE6A000-memory.dmp

    Filesize

    40KB

  • memory/2924-96-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-63-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/2924-61-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/2924-60-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/2924-79-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-24-0x0000000180000000-0x0000000180005000-memory.dmp

    Filesize

    20KB

  • memory/2924-0-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-65-0x00000000028D0000-0x00000000028DA000-memory.dmp

    Filesize

    40KB

  • memory/2924-103-0x000000001E230000-0x000000001E24C000-memory.dmp

    Filesize

    112KB

  • memory/2924-114-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-115-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-116-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-117-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-118-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-119-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-120-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-121-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-122-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-523-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-3982-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-85-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

    Filesize

    9.9MB

  • memory/2924-3980-0x000007FEF5983000-0x000007FEF5984000-memory.dmp

    Filesize

    4KB

  • memory/3288-3916-0x000000001F7F0000-0x000000001F82A000-memory.dmp

    Filesize

    232KB

  • memory/3288-3965-0x00000000200F0000-0x0000000020164000-memory.dmp

    Filesize

    464KB

  • memory/3288-3979-0x0000000020270000-0x00000000202BA000-memory.dmp

    Filesize

    296KB

  • memory/3288-3931-0x000000001F8E0000-0x000000001F990000-memory.dmp

    Filesize

    704KB

  • memory/3288-3902-0x000000001F790000-0x000000001F7A2000-memory.dmp

    Filesize

    72KB

  • memory/3288-3888-0x000000001F750000-0x000000001F76A000-memory.dmp

    Filesize

    104KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.