Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-11-2020 06:16
General
-
Target
b76964a44b67b1f41a7f1feb9bfebe75.exe
-
Size
327KB
-
MD5
b76964a44b67b1f41a7f1feb9bfebe75
-
SHA1
2d050b2b99381ede6c179934d3492be20a05f3b5
-
SHA256
566b744e0e0b789f5ba0502144328af1df9483cfbd80a0efc7437aec176c3ac6
-
SHA512
e47061cbb64eb1fcaf97a4783ba95c60248517f7457e049192b67f25e229f50e8d8159f88d02bd4668806eda77d029f7dca3425254a5dc70646a3c9e95365541
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b76964a44b67b1f41a7f1feb9bfebe75.exe"C:\Users\Admin\AppData\Local\Temp\b76964a44b67b1f41a7f1feb9bfebe75.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1700-0-0x000000000249A000-0x00000000024AB000-memory.dmpFilesize
68KB
-
memory/1700-1-0x0000000002590000-0x00000000025A1000-memory.dmpFilesize
68KB
-
memory/1700-2-0x0000000003E00000-0x0000000003E11000-memory.dmpFilesize
68KB
-
memory/1700-3-0x0000000073F20000-0x000000007460E000-memory.dmpFilesize
6.9MB
-
memory/1700-4-0x0000000003D90000-0x0000000003DB4000-memory.dmpFilesize
144KB
-
memory/1700-5-0x0000000003F00000-0x0000000003F22000-memory.dmpFilesize
136KB