Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
823ce35710b45a4965c51c492e8c26f6290dce68.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
823ce35710b45a4965c51c492e8c26f6290dce68.exe
Resource
win10v2004-20241007-en
General
-
Target
823ce35710b45a4965c51c492e8c26f6290dce68.exe
-
Size
309KB
-
MD5
85eeee46359bd56d41e152aeb804b3dd
-
SHA1
823ce35710b45a4965c51c492e8c26f6290dce68
-
SHA256
3cbe4cea4f66dfdafbd2149406ba0567e3e37502c2cb82a386f563af27cdd036
-
SHA512
baa263c16eda4e194223343988b58b1960e9f87d2a7ef27a5ad7c33d7a68ae36aeff3a04e4aab649d52689d8929f39a10746b30f474e97043b633a1b36fd1fd2
-
SSDEEP
6144:qaRrP68EcS+htH8mM1SmyKniAOkL2CkLqYB/Oa7LlVS:qwzlEcS+hxoSEijBWinS
Malware Config
Extracted
redline
REDLINEVIP (TG: @Fatherofcarders) 150K
178.32.215.163:17189
-
auth_value
0f7b7a0ecd1083169a37fc5d6e242919
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/2396-1-0x0000000000410000-0x0000000000430000-memory.dmp family_redline -
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 823ce35710b45a4965c51c492e8c26f6290dce68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87 PID 1836 wrote to memory of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87 PID 1836 wrote to memory of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87 PID 1836 wrote to memory of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87 PID 1836 wrote to memory of 2396 1836 823ce35710b45a4965c51c492e8c26f6290dce68.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\823ce35710b45a4965c51c492e8c26f6290dce68.exe"C:\Users\Admin\AppData\Local\Temp\823ce35710b45a4965c51c492e8c26f6290dce68.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2396
-