Analysis
-
max time kernel
111s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe
Resource
win10v2004-20241007-en
General
-
Target
d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe
-
Size
381KB
-
MD5
075d4ab2384748fbe19e8fae3ca99aca
-
SHA1
929750fb6377a712955ff83bc40b4a0712c6399c
-
SHA256
1f40932e41723842147ccbe1203672d942706e9e25451f20513f10b682a1dc14
-
SHA512
32e19acc2bfa9a47ecc598b3f2e7c2c80a82d69c98b950cfcc370fcfcb062a2526a3a480d1a6b10a1c18143ad1e155211e7fa6e36c9781ca977c6ec55d50e9fa
-
SSDEEP
6144:dBJk9av85lgrciUnEOqGRPW8ETxPLsYp8:dXkEvEgrciUEOq0PEVL9p8
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/812-4-0x0000000004DF0000-0x0000000004E2C000-memory.dmp family_redline behavioral2/memory/812-6-0x0000000004F90000-0x0000000004FCA000-memory.dmp family_redline behavioral2/memory/812-9-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-25-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-11-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-71-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-69-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-67-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-65-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-63-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-61-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-57-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-55-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-53-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-51-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-49-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-47-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-45-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-43-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-41-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-39-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-35-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-33-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-32-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-29-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-27-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-23-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-21-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-19-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-17-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-15-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-13-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-8-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-59-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline behavioral2/memory/812-37-0x0000000004F90000-0x0000000004FC5000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 812 d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe"C:\Users\Admin\AppData\Local\Temp\d09aa6676bc3339ae6bbb1d74258c397a882a05cec69d429e993615d26fb3a13N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:812