redline | 64b9457cd80939e1e02d22607e1faae7787d60cc8ccff068f1b0ab2b2c1b8057

Analysis

max time kernel
10s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nichiden Viet Nam - RFQ List & Specification..exe
Size

184KB
MD5

5a5469ff7562aa34384f44eee04643e1
SHA1

d894b3eb2d2cc3bcebfec296fbf5457cdd77a4b0
SHA256

64b9457cd80939e1e02d22607e1faae7787d60cc8ccff068f1b0ab2b2c1b8057
SHA512

51b9e53654e79a14e57e03200b38285f4218c62d68929cfecbeb02296386f2266edc324e619925d981de0e9285c2a5acbba1126dfa0d1d484e1627c438ce5aec
SSDEEP

1536:AfLsxO9kR8Bx09kANXrA32aF5D1osgrvzsVxI:xO9KUTF3LFx1osMveI

Score

10^/10

redline foz infostealer

Malware Config

Extracted

Family

redline

Botnet

foz

79.110.62.113:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2016-4886-0x0000000000400000-0x0000000000452000-memory.dmp family_redline
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Nichiden Viet Nam - RFQ List & Specification..exe

description pid process

Token: SeDebugPrivilege 1444 Nichiden Viet Nam - RFQ List & Specification..exe

resource	yara_rule
behavioral1/memory/2016-4886-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

description	pid	process
Token: SeDebugPrivilege	1444	Nichiden Viet Nam - RFQ List & Specification..exe

C:\Users\Admin\AppData\Local\Temp\Nichiden Viet Nam - RFQ List & Specification..exe
"C:\Users\Admin\AppData\Local\Temp\Nichiden Viet Nam - RFQ List & Specification..exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-21-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-7-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-2-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/1444-3-0x0000000007790000-0x00000000079C6000-memory.dmp

Filesize
2.2MB

Download
memory/1444-4-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-5-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-67-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-43-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-41-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-9-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-60-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-65-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-11-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-13-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-15-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-17-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-19-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-23-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-25-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-27-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

Filesize
4KB

Download
memory/1444-31-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-33-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-35-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-29-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-1-0x0000000000CD0000-0x0000000000D04000-memory.dmp

Filesize
208KB

Download
memory/1444-62-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-63-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-4866-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/1444-57-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-55-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-53-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-51-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-49-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-47-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-4868-0x0000000004960000-0x00000000049AC000-memory.dmp

Filesize
304KB

Download
memory/1444-4867-0x0000000005170000-0x00000000051E4000-memory.dmp

Filesize
464KB

Download
memory/1444-45-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-39-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-37-0x0000000007790000-0x00000000079C1000-memory.dmp

Filesize
2.2MB

Download
memory/1444-4869-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

Filesize
4KB

Download
memory/1444-4870-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/1444-4871-0x0000000004D00000-0x0000000004D54000-memory.dmp

Filesize
336KB

Download
memory/1444-4888-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2016-4887-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2016-4889-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2016-4886-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2016-4890-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download
memory/2016-4891-0x0000000074E00000-0x00000000754EE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads