Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 22:34
Static task
static1
Behavioral task
behavioral1
Sample
86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe
Resource
win10v2004-20241007-en
General
-
Target
86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe
-
Size
423KB
-
MD5
c8d184970bfd93d5adf803c21ed6e634
-
SHA1
0a86dbd6143a8e146060f7001bd4b49a97fa2734
-
SHA256
86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59
-
SHA512
64ff2df9540ce6a61608dc7f74d50b2e3c4b94cd5aa99b0b69b22e9236dd639023200e5315b22eff2cd3300c925fc90c1850fc06788097aa466a980ecf26b6db
-
SSDEEP
6144:lF0QwcHpDxNC/vcfL4r/7Rvyx2BOxZWpWmYgwzOdrePY5hfm:lG0xEiErD1YNxZWpWmYwdreP5
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/4884-5-0x00000000023C0000-0x00000000023F4000-memory.dmp family_redline behavioral2/memory/4884-7-0x0000000002690000-0x00000000026C2000-memory.dmp family_redline behavioral2/memory/4884-53-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-51-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-71-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-69-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-65-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-63-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-59-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-57-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-56-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-49-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-47-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-43-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-41-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-39-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-37-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-33-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-31-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-27-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-25-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-67-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-61-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-45-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-35-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-29-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-23-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-21-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-19-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-17-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-15-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-13-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-11-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-9-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline behavioral2/memory/4884-8-0x0000000002690000-0x00000000026BC000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4884 86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe"C:\Users\Admin\AppData\Local\Temp\86a967becd06aefafce30d9836e43a21daa890a3db2dd6014aa0b9b58aeefe59.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4884