Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2024, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe
Resource
win10v2004-20241007-en
General
-
Target
3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe
-
Size
486KB
-
MD5
4e1c920486c096f4f8e884e3b1247770
-
SHA1
a2773d6892e5bae80ba9a27ae01691fa5c5a10f9
-
SHA256
3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429
-
SHA512
a3577cbdf1b23480dde2d5afebc3987a7b8c58bce0cdd6284c5a6eca4526f257a4f0fa5c25fc8b7ef3d66630facbf4019da062cd2e9ead974fe14f9bd0f3d33e
-
SSDEEP
6144:KvwrQF+cmlcSHgzaNr3hxOZ+nn4HxPaVWbaJbaylkk17cDGVdgQkpIv:KvpF1mNHOaNTPOlR6WbQSg7caoQkav
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/5024-5-0x0000000002700000-0x000000000273C000-memory.dmp family_redline behavioral2/memory/5024-7-0x0000000004F40000-0x0000000004F7A000-memory.dmp family_redline behavioral2/memory/5024-23-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-29-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-71-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-69-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-67-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-66-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-63-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-61-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-59-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-57-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-55-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-53-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-51-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-49-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-47-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-45-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-43-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-41-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-39-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-37-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-35-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-33-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-31-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-28-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-25-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-21-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-19-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-17-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-15-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-13-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-11-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-9-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline behavioral2/memory/5024-8-0x0000000004F40000-0x0000000004F75000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5024 3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe"C:\Users\Admin\AppData\Local\Temp\3822787f40f9c8936e0c2eed5e746f3c23de167e74101dfda9f9a9758701b429N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5024