Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 01:16
Static task
static1
Behavioral task
behavioral1
Sample
08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe
Resource
win10v2004-20241007-en
General
-
Target
08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe
-
Size
383KB
-
MD5
1f80b4497c9d7459b53823541e44552a
-
SHA1
abac954b360bc13aea4ac42d1883769d3dc51594
-
SHA256
08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8
-
SHA512
0a390a78c399b6e5066a7b8e4a518c841528b0414b7120af42f31fdea2642cc20d25ad0d6951c81b9eec3d40f2c3776bf71bf41fc8ad0c8b4849643f76dfd71b
-
SSDEEP
6144:ANaJ3TPjifAJdT1HhGB35wOx6irIvIG6PDdmXb7ITsqXigaXwVfZ:+eTbMAJdxsXx6Dv4dk7R
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2844-3-0x0000000004780000-0x00000000047B4000-memory.dmp family_redline behavioral1/memory/2844-4-0x00000000047C0000-0x00000000047F2000-memory.dmp family_redline behavioral1/memory/2844-6-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-7-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-9-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-29-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-27-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-25-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-23-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-21-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-19-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-17-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-15-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-13-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-11-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-47-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-45-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-43-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-41-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-39-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-37-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-35-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-33-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-31-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-49-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-51-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-53-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-55-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-57-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-59-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-61-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-63-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-65-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-67-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline behavioral1/memory/2844-69-0x00000000047C0000-0x00000000047EC000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2844 08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe"C:\Users\Admin\AppData\Local\Temp\08b46c8ce21b3b5d68538685dccc6a54eb9390dcd91fa4a88f4e6e87492fe6c8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2844