Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/11/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe
Resource
win10v2004-20241007-en
General
-
Target
df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe
-
Size
433KB
-
MD5
0cfe0d8ea27fd4059d0eb249396451fd
-
SHA1
abbf215a11b33e015118f9b8ca648088f3f3be10
-
SHA256
df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494
-
SHA512
aac474421dd5392ad61ba96a86c5fc2d35ba8576008e68c326ba4c3ffdf83e6d30d96f1deda6271e600534a758ab7e9c6ae23f31003b39c8c5cb4cd59a7fecca
-
SSDEEP
6144:gkzT5Nf9ZbDnOgfq1HjKNi+Hn33b8poHwiMc4oKoN3:fT5XZ+gfqdjKNdHn33bAoHwQ4oKM
Malware Config
Extracted
redline
asia
45.9.20.240:46257
-
auth_value
218353fc70f3440d970e02bf6e2edeb1
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/1720-5-0x00000000005F0000-0x0000000000624000-memory.dmp family_redline behavioral1/memory/1720-6-0x0000000001FB0000-0x0000000001FE2000-memory.dmp family_redline behavioral1/memory/1720-7-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-8-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-10-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-14-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-20-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-18-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-16-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-12-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-22-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-24-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-26-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-28-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-48-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-30-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-32-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-34-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-36-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-38-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-40-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-52-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-56-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-60-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-70-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-68-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-66-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-64-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-62-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-58-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-54-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-50-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-46-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-44-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline behavioral1/memory/1720-42-0x0000000001FB0000-0x0000000001FDD000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1720 df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe"C:\Users\Admin\AppData\Local\Temp\df4da65d03a3a9b72b748282f3ddda4d2d50bf6a061f75cb260fad9c5781e494.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1720