Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
Resource
win10v2004-20241007-en
General
-
Target
a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe
-
Size
770.0MB
-
MD5
a5a83474450554b7da04587cf77f76ec
-
SHA1
a8a579d8a66f4875df9cbed1a2a6c3392b232853
-
SHA256
b4781474596c183da5b10c22ce2260c802ef4f553ed347f4813ad30cab0d56e2
-
SHA512
db5c11cab72ccd89de9982c1dd5488e608195f795c5118f31160dab4a01c86d439ca9ddb37212647c38e0eac4d6394d3e47fe9c1e340f1f4cf95856e54624ee5
-
SSDEEP
12288:anAcUmI0cmsN0C1pXVnljw7zSrmP2LszN2lRjFoC8GJx5v:aY0mygdVlM7zSsWRSCv3R
Malware Config
Extracted
redline
word 7
65.21.74.139:20775
-
auth_value
fc283e807b7b9afa9b29c1b782aad551
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/7916-2840-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 7748 powershell.exe 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe Token: SeDebugPrivilege 7748 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2420 wrote to memory of 7748 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 31 PID 2420 wrote to memory of 7748 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 31 PID 2420 wrote to memory of 7748 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 31 PID 2420 wrote to memory of 7748 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 31 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33 PID 2420 wrote to memory of 7916 2420 a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe"C:\Users\Admin\AppData\Local\Temp\a8a579d8a66f4875df9cbed1a2a6c3392b232853.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7748
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- System Location Discovery: System Language Discovery
PID:7916
-