Overview
overview
10Static
static
10Redline.St...ed.rar
windows7-x64
7Redline.St...ed.rar
windows10-2004-x64
1Redline St...52.dll
windows7-x64
1Redline St...52.dll
windows10-2004-x64
1Redline St...ng.dll
windows7-x64
1Redline St...ng.dll
windows10-2004-x64
1Redline St...ib.dll
windows7-x64
1Redline St...ib.dll
windows10-2004-x64
1Redline St...or.dll
windows7-x64
1Redline St...or.dll
windows10-2004-x64
1Redline St...Db.bin
windows7-x64
1Redline St...Db.bin
windows10-2004-x64
1Redline St...Db.bin
windows7-x64
1Redline St...Db.bin
windows10-2004-x64
1Redline St...UI.dll
windows7-x64
1Redline St...UI.dll
windows10-2004-x64
1Redline St...es.dll
windows7-x64
1Redline St...es.dll
windows10-2004-x64
1Redline St...tp.dll
windows7-x64
1Redline St...tp.dll
windows10-2004-x64
1Redline St...ma.dll
windows7-x64
1Redline St...ma.dll
windows10-2004-x64
1Redline St...on.dll
windows7-x64
1Redline St...on.dll
windows10-2004-x64
1Redline St...el.exe
windows7-x64
3Redline St...el.exe
windows10-2004-x64
7Redline St...config
windows7-x64
1Redline St...config
windows10-2004-x64
1Redline St...to.dll
windows7-x64
1Redline St...to.dll
windows10-2004-x64
1Redline St...rp.dll
windows7-x64
1Redline St...rp.dll
windows10-2004-x64
1Analysis
-
max time kernel
66s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-01-2025 21:47
Behavioral task
behavioral1
Sample
Redline.Stealer.v30.2.Cracked.rar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Redline.Stealer.v30.2.Cracked.rar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Bunifu_UI_v1.52.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Bunifu_UI_v1.52.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Common.Logging.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Common.Logging.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/GuiLib.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral8
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/GuiLib.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IPLocator.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral10
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IPLocator.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IpDb/IpDb.bin
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IpDb/IpDb.bin
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IpDb/Ipv6Db.bin
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/IpDb/Ipv6Db.bin
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/MetroSet UI.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/MetroSet UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Microsoft.Bcl.AsyncInterfaces.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/NHttp.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/NHttp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Newtonsoft.Json.Schema.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Newtonsoft.Json.Schema.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Panel.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Panel.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Panel.exe.config
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Panel.exe.config
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Pluralsight.Crypto.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/Pluralsight.Crypto.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/RestSharp.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Redline Stealer v30.2 Cracked By @Drcrypt0r/Panel/RestSharp.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Redline.Stealer.v30.2.Cracked.rar
-
Size
35.9MB
-
MD5
ea3f5a9a0a1656e048a2640ca4007481
-
SHA1
3169637282b23fa49c4e5c6f3645157ab24722c7
-
SHA256
b5cd68d3b2d6e79a5d15fa737dfae474a39aa7910759f7ca28bc1d9804359a44
-
SHA512
ddd96a0857d5ba3041960eb565ee79990fd6d28d7438865e3400fadbf4446c2034f79bc0dc0787dd3d675bc8b9c6607b468747bf161a06a752cf17f3a9f6cd79
-
SSDEEP
786432:pwssBHZtEPztNd1SzC4lqjAbYciGOARzXT/zA9kz:pzatEPJN/LkbTHj/7z
Malware Config
Signatures
-
Executes dropped EXE 9 IoCs
pid Process 2192 Panel.exe 2060 Panel.exe 2668 Panel.exe 2588 Panel.exe 2312 Panel.exe 1040 Panel.exe 1812 Panel.exe 756 Panel.exe 2920 Panel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 Panel.exe 2060 Panel.exe 2192 Panel.exe 2060 Panel.exe 2192 Panel.exe 2192 Panel.exe 2192 Panel.exe 2192 Panel.exe 2668 Panel.exe 2192 Panel.exe 2668 Panel.exe 2192 Panel.exe 2668 Panel.exe 2192 Panel.exe 2668 Panel.exe 2192 Panel.exe 2668 Panel.exe 2192 Panel.exe 2192 Panel.exe 2192 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2588 Panel.exe 2192 Panel.exe 2312 Panel.exe 1040 Panel.exe 2588 Panel.exe 2192 Panel.exe 2312 Panel.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1248 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeRestorePrivilege 1248 7zFM.exe Token: 35 1248 7zFM.exe Token: SeSecurityPrivilege 1248 7zFM.exe Token: SeDebugPrivilege 2192 Panel.exe Token: SeDebugPrivilege 2060 Panel.exe Token: SeDebugPrivilege 2668 Panel.exe Token: SeDebugPrivilege 2588 Panel.exe Token: SeSecurityPrivilege 1248 7zFM.exe Token: SeDebugPrivilege 2312 Panel.exe Token: SeDebugPrivilege 1040 Panel.exe Token: SeDebugPrivilege 1812 Panel.exe Token: SeDebugPrivilege 756 Panel.exe Token: SeDebugPrivilege 2920 Panel.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1248 7zFM.exe 1248 7zFM.exe 1248 7zFM.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1248 wrote to memory of 2192 1248 7zFM.exe 31 PID 1248 wrote to memory of 2192 1248 7zFM.exe 31 PID 1248 wrote to memory of 2192 1248 7zFM.exe 31 PID 2192 wrote to memory of 2060 2192 Panel.exe 32 PID 2192 wrote to memory of 2060 2192 Panel.exe 32 PID 2192 wrote to memory of 2060 2192 Panel.exe 32 PID 2060 wrote to memory of 2628 2060 Panel.exe 34 PID 2060 wrote to memory of 2628 2060 Panel.exe 34 PID 2060 wrote to memory of 2628 2060 Panel.exe 34 PID 2192 wrote to memory of 2668 2192 Panel.exe 35 PID 2192 wrote to memory of 2668 2192 Panel.exe 35 PID 2192 wrote to memory of 2668 2192 Panel.exe 35 PID 2668 wrote to memory of 2952 2668 Panel.exe 36 PID 2668 wrote to memory of 2952 2668 Panel.exe 36 PID 2668 wrote to memory of 2952 2668 Panel.exe 36 PID 2192 wrote to memory of 2588 2192 Panel.exe 37 PID 2192 wrote to memory of 2588 2192 Panel.exe 37 PID 2192 wrote to memory of 2588 2192 Panel.exe 37 PID 2312 wrote to memory of 1040 2312 Panel.exe 41 PID 2312 wrote to memory of 1040 2312 Panel.exe 41 PID 2312 wrote to memory of 1040 2312 Panel.exe 41 PID 2588 wrote to memory of 2804 2588 Panel.exe 42 PID 2588 wrote to memory of 2804 2588 Panel.exe 42 PID 2588 wrote to memory of 2804 2588 Panel.exe 42 PID 2192 wrote to memory of 1812 2192 Panel.exe 43 PID 2192 wrote to memory of 1812 2192 Panel.exe 43 PID 2192 wrote to memory of 1812 2192 Panel.exe 43 PID 1812 wrote to memory of 1604 1812 Panel.exe 44 PID 1812 wrote to memory of 1604 1812 Panel.exe 44 PID 1812 wrote to memory of 1604 1812 Panel.exe 44 PID 2192 wrote to memory of 756 2192 Panel.exe 45 PID 2192 wrote to memory of 756 2192 Panel.exe 45 PID 2192 wrote to memory of 756 2192 Panel.exe 45 PID 756 wrote to memory of 1036 756 Panel.exe 46 PID 756 wrote to memory of 1036 756 Panel.exe 46 PID 756 wrote to memory of 1036 756 Panel.exe 46 PID 2192 wrote to memory of 2920 2192 Panel.exe 47 PID 2192 wrote to memory of 2920 2192 Panel.exe 47 PID 2192 wrote to memory of 2920 2192 Panel.exe 47
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Redline.Stealer.v30.2.Cracked.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2060 -s 5684⤵PID:2628
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2668 -s 5684⤵PID:2952
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2588 -s 5684⤵PID:2804
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1812 -s 5764⤵PID:1604
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 756 -s 5684⤵PID:1036
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe"C:\Users\Admin\AppData\Local\Temp\7zO0E49B2F6\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Users\Admin\Desktop\New folder\Panel.exe"C:\Users\Admin\Desktop\New folder\Panel.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\Desktop\New folder\Panel.exe"C:\Users\Admin\Desktop\New folder\Panel.exe" "--monitor"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD585afedf22ca7d0561be4443e854459a7
SHA11fec08de68672a302f0df40ff30b22cee4d18057
SHA256130a2379f8f07cec2cd9935bdf67bfcfbb977327f89f017dc16f19efc871d864
SHA512e5229c4e67bc7d4ef8b53c94cfd017833797ecb52a93d71e9770ae50aaaa8e3e6c9b6433389f85255c2fe92bf94bdf1f6d1c49a01ac0809d7c8ccdb8c07dce03
-
Filesize
26KB
MD514c52be5c2f2e05b34c971ab1c5a1f6e
SHA1ca6af3aeef6b4f7d0b9d9199b985251d29aa65e2
SHA25646de03cb4b125529c7aaf6024d3a287fb7c01bc5514664aae89d1a2f05af951a
SHA5129266c85eb86115eef864e18bc46a5d2aae82e81ddbffc1589bad308ab1f7122d8a92bb5260e957a97350190bcaad27e93ad2bc1f7db1aaddc1c44a80dc728108