redline | d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 01:24

Target

d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe
Size

141KB
MD5

19e47b9abf123f4502545a5fcb43c855
SHA1

c722baba8294f20abdb344b61d72d444a4171b62
SHA256

d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2
SHA512

8c358748e913fdf227b58f6a46719fa7582295e30dcfe9b06fce624240d066f666d481d661ee42b106ff32e78877993d9680e921a9bc1fca4aa00269d2b09173
SSDEEP

3072:FK1JZOpTvVQZ+rcIeRYs6YmszJqoD2X7BpGGoMTb3R35dINX9r59x4:kOpu0rjeRbVJqoDC1pGGoMTb3RDINN

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2148-1-0x0000000000A60000-0x0000000000A8A000-memory.dmp family_redline
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2148-1-0x0000000000A60000-0x0000000000A8A000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3964 taskkill.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2148 d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe
Token: SeDebugPrivilege 3964 taskkill.exe

resource	yara_rule
behavioral2/memory/2148-1-0x0000000000A60000-0x0000000000A8A000-memory.dmp	family_redline

resource	yara_rule
behavioral2/memory/2148-1-0x0000000000A60000-0x0000000000A8A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

pid	process
3964	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2148	d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe
Token: SeDebugPrivilege	3964	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.execmd.exe

description	pid	process	target process
PID 2148 wrote to memory of 2680	2148	d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe	cmd.exe
PID 2148 wrote to memory of 2680	2148	d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe	cmd.exe
PID 2148 wrote to memory of 2680	2148	d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe	cmd.exe
PID 2680 wrote to memory of 3964	2680	cmd.exe	taskkill.exe
PID 2680 wrote to memory of 3964	2680	cmd.exe	taskkill.exe
PID 2680 wrote to memory of 3964	2680	cmd.exe	taskkill.exe
PID 2680 wrote to memory of 612	2680	cmd.exe	choice.exe
PID 2680 wrote to memory of 612	2680	cmd.exe	choice.exe
PID 2680 wrote to memory of 612	2680	cmd.exe	choice.exe

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 2148 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2680

memory/2148-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x0000000000A60000-0x0000000000A8A000-memory.dmp

Filesize
168KB

Download
memory/2148-2-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download
memory/2148-3-0x0000000005A20000-0x0000000006038000-memory.dmp

Filesize
6.1MB

Download
memory/2148-4-0x0000000005450000-0x0000000005462000-memory.dmp

Filesize
72KB

Download
memory/2148-5-0x00000000054B0000-0x00000000054EC000-memory.dmp

Filesize
240KB

Download
memory/2148-6-0x00000000054F0000-0x000000000553C000-memory.dmp

Filesize
304KB

Download
memory/2148-7-0x0000000005760000-0x000000000586A000-memory.dmp

Filesize
1.0MB

Download
memory/2148-8-0x0000000074CB0000-0x0000000075460000-memory.dmp

Filesize
7.7MB

Download