Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 22:59
Static task
static1
Behavioral task
behavioral1
Sample
6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe
Resource
win10v2004-20241007-en
General
-
Target
6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe
-
Size
297KB
-
MD5
5269de82606586359ab85bba6cf33d99
-
SHA1
8574c6fe2429b7c72f0f77dd69e7f960dbd8a310
-
SHA256
6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85
-
SHA512
d48f0b06ab70b115bfd4184a91741e418f37143f1a2546b76f9c6eacd017efc8f5e00ae7a1186ab1f3ba296af91c67c473cf06acb38fdf2c8340b2368c761cd6
-
SSDEEP
6144:bHX+iXvoPGKN3MYAXcK6YWo2mYLVe2PRy6u802JJs:b3+iXvoPoYISTLVHZy6zJ
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/380-3-0x0000000004950000-0x0000000004984000-memory.dmp family_redline behavioral2/memory/380-5-0x0000000004D40000-0x0000000004D72000-memory.dmp family_redline behavioral2/memory/380-14-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-70-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-68-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-66-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-64-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-60-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-58-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-56-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-54-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-52-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-50-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-48-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-44-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-42-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-40-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-38-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-36-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-34-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-32-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-28-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-26-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-24-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-22-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-21-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-18-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-16-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-12-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-10-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-8-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-7-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-62-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-46-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline behavioral2/memory/380-30-0x0000000004D40000-0x0000000004D6C000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 380 6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe"C:\Users\Admin\AppData\Local\Temp\6b3dea6696efd984f37d1a80a27e7908987ac6545c2129d3c0869786ba965b85.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:380