5e511e5ef8d11046dae403ecb2299c18320d9ccc1ede9fdaff63ef5d42672753 | Triage™

Analysis

max time kernel
60s
max time network
65s
platform
windows7_x64
resource
win7
submitted
10/07/2020, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedLine.exe
Size 357KB
Sample200710-vg3hexm7tx
SHA256 5e511e5ef8d11046dae403ecb2299c18320d9ccc1ede9fdaff63ef5d42672753
MD5 b67bd93ed7a4d16868b2b688f53e2ffc
SHA1 0206889856f95172091eaee2e7f55de18d5ed2df
SHA512 f948bb912823b0b4ecbfc954bf9fc09c73ba22bf74cafe581ae8ffe3d5a0e7418665c4d068670aa7c4618f188fbea4019255bb0820177961f70daeecd1e1087b
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	RedLine.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

C:\Users\Admin\AppData\Local\Temp\RedLine.exe
"C:\Users\Admin\AppData\Local\Temp\RedLine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads