Overview
overview
10Static
static
3Setup_latest.exe
windows7-x64
Setup_latest.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...en.exe
windows7-x64
4$R0/Uninst...en.exe
windows10-2004-x64
$PLUGINSDI...ls.dll
windows7-x64
$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 23:12
Static task
static1
Behavioral task
behavioral1
Sample
Setup_latest.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Setup_latest.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
$R0/Uninstall Bitwarden.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
$R0/Uninstall Bitwarden.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240611-en
General
-
Target
Setup_latest.exe
-
Size
1.4MB
-
MD5
eb48500860ece87bc7a169118c929fb3
-
SHA1
bb20b2598d5ac31d36717f316fc733c4f8df9a9c
-
SHA256
b96862087581adb9ecfb9615a46eedb29d13c606e708b7b532ce6ed3217925a4
-
SHA512
d595378bdc733b17697a5aa075e78082e863189255594f6c805380e745ea0bd66631bd3d58289f5c4b051c5073b61fe1ad70953ef84d305397b6ecf296789c9c
-
SSDEEP
24576:ZxgPnpq2yAY1szLSvJwv4ahekPxMB7Du173pG1szLSvJwv4a:EnpNyA9qvCvHOBK73pfqvCv
Malware Config
Extracted
redline
red
147.45.44.12:13830
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5040-4-0x0000000004E30000-0x0000000004E80000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Setup_latest.exepid process 5040 Setup_latest.exe 5040 Setup_latest.exe 5040 Setup_latest.exe 5040 Setup_latest.exe 5040 Setup_latest.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Setup_latest.exedescription pid process Token: SeDebugPrivilege 5040 Setup_latest.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5040-0-0x00000000022A0000-0x00000000022F0000-memory.dmpFilesize
320KB
-
memory/5040-2-0x00000000022A0000-0x00000000022F0000-memory.dmpFilesize
320KB
-
memory/5040-3-0x00000000745EE000-0x00000000745EF000-memory.dmpFilesize
4KB
-
memory/5040-4-0x0000000004E30000-0x0000000004E80000-memory.dmpFilesize
320KB
-
memory/5040-5-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB
-
memory/5040-7-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB
-
memory/5040-6-0x0000000004F20000-0x00000000054C4000-memory.dmpFilesize
5.6MB
-
memory/5040-8-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB
-
memory/5040-9-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/5040-10-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB
-
memory/5040-11-0x00000000055F0000-0x00000000055FA000-memory.dmpFilesize
40KB
-
memory/5040-12-0x0000000005B30000-0x0000000006148000-memory.dmpFilesize
6.1MB
-
memory/5040-13-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/5040-14-0x00000000056B0000-0x00000000056C2000-memory.dmpFilesize
72KB
-
memory/5040-15-0x00000000056D0000-0x000000000570C000-memory.dmpFilesize
240KB
-
memory/5040-16-0x00000000058B0000-0x00000000058FC000-memory.dmpFilesize
304KB
-
memory/5040-17-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB
-
memory/5040-18-0x00000000074B0000-0x0000000007672000-memory.dmpFilesize
1.8MB
-
memory/5040-19-0x0000000007680000-0x0000000007BAC000-memory.dmpFilesize
5.2MB
-
memory/5040-20-0x0000000007C50000-0x0000000007CA0000-memory.dmpFilesize
320KB
-
memory/5040-21-0x00000000745EE000-0x00000000745EF000-memory.dmpFilesize
4KB
-
memory/5040-22-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB
-
memory/5040-26-0x00000000745E0000-0x0000000074D90000-memory.dmpFilesize
7.7MB