Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 18:40
Static task
static1
Behavioral task
behavioral1
Sample
a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe
Resource
win10v2004-20241007-en
General
-
Target
a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe
-
Size
360KB
-
MD5
7872ef4ae26dd159a7b01dd5b906398f
-
SHA1
2e30d128d2664cff45482535d8d9484f392a852c
-
SHA256
a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5
-
SHA512
92458d87e022847996b55c7812d2e17aa9b338872635bf8150b854e4d4e99783ac0ba895a2637920abcf15e102c6010b77ea0d1c6be4cfaafbb270c2ec9775b1
-
SSDEEP
6144:YjszWh028o0/7PLQuhUACybJfEpSsVtarYPDWJs:msC0eSzO/yJfCTp
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/4864-4-0x00000000072A0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/4864-6-0x0000000007320000-0x000000000735A000-memory.dmp family_redline behavioral2/memory/4864-9-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-13-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-71-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-69-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-65-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-63-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-61-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-59-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-57-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-55-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-53-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-51-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-49-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-47-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-45-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-41-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-39-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-37-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-35-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-33-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-31-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-27-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-25-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-23-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-21-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-19-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-17-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-15-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-11-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-8-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-67-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-43-0x0000000007320000-0x0000000007355000-memory.dmp family_redline behavioral2/memory/4864-29-0x0000000007320000-0x0000000007355000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4864 a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe"C:\Users\Admin\AppData\Local\Temp\a41e42a70a20b6c1afa20309afffbd0f9fa5a56e561a4bad8bf7704b953788f5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4864