Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe
Resource
win10v2004-20241007-en
General
-
Target
137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe
-
Size
352KB
-
MD5
7e914b9e0d4b4f88c8cffdda7f20757b
-
SHA1
418b9af8a6f59458ed18324aeccda8543b6172e5
-
SHA256
137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d
-
SHA512
10ff03b0b53c40dfef6a67fdbb337665bc84faf02c94825196945acad54294b9381640eedaeaa5cedc590237eed0e3eaca4d597aa91b2241bfcc1bb15d1bfde0
-
SSDEEP
6144:5byFigFct4ZGui6YGIX/aYtAt3XXOFhEuo/:5byIg+PGIaLt3XX
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/960-4-0x0000000004E10000-0x0000000004E4C000-memory.dmp family_redline behavioral2/memory/960-6-0x0000000004FA0000-0x0000000004FDA000-memory.dmp family_redline behavioral2/memory/960-8-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-65-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-57-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-55-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-53-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-51-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-49-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-45-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-33-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-71-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-69-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-67-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-63-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-62-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-59-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-47-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-43-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-41-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-40-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-37-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-35-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-31-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-29-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-27-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-25-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-23-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-21-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-19-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-17-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-15-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-13-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-11-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline behavioral2/memory/960-9-0x0000000004FA0000-0x0000000004FD5000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 960 137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe"C:\Users\Admin\AppData\Local\Temp\137c1f71f85cf3275f836da13481e98ea1ac90f0b80c12fc6efe9a0fbf37717d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:960