Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe
Resource
win10v2004-20241007-en
General
-
Target
7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe
-
Size
297KB
-
MD5
90d48a7919a02ddb38d6bba681f3ed6c
-
SHA1
8643fda08658759329bd5be0a4870a369d65d077
-
SHA256
7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee
-
SHA512
e2395d454da4aca0f821d55e65c4a3943583113346b5d02ef4e788b3668452f84263b7b215c10c6d171412979b8f5ce40a6a470bd148a2f07daae0d6cd1b4465
-
SSDEEP
6144:UvHwCMbovF9JUKbHGTRfcfX1m3fbGKUBjcFPx76COzuS92:UPwCMbovF9JUKrGTRVCKajcfgzu
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2368-3-0x0000000004710000-0x0000000004744000-memory.dmp family_redline behavioral1/memory/2368-4-0x0000000006EC0000-0x0000000006EF2000-memory.dmp family_redline behavioral1/memory/2368-69-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-67-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-65-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-63-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-61-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-59-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-57-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-55-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-53-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-51-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-49-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-47-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-45-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-43-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-41-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-39-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-37-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-35-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-33-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-31-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-29-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-27-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-25-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-23-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-21-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-19-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-17-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-15-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-13-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-11-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-9-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-7-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline behavioral1/memory/2368-6-0x0000000006EC0000-0x0000000006EEC000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2368 7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe"C:\Users\Admin\AppData\Local\Temp\7ae03527ad9fd0291715b0b916612678eb9912392da4392b2937486965f839ee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2368
Network
- No results found
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3