Analysis
- max time kernel
8s - max time network
8s - platform
windows10_x64 - resource
win10v20201028 - submitted
07/12/2020, 19:02
General
- Target db78b6b4e4ace66632b1b7d746f1d716.exe
- Size 381KB
- Sample201207-d8vsnes6hx
- SHA256 7afefba65e72f42925ba76fae9ea98286eff7d0d01dcccd07c6117384858b6bb
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db78b6b4e4ace66632b1b7d746f1d716.exe"C:\Users\Admin\AppData\Local\Temp\db78b6b4e4ace66632b1b7d746f1d716.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4760-2-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/4760-3-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/4760-4-0x0000000073050000-0x000000007373E000-memory.dmp
memory/4760-5-0x0000000002A10000-0x0000000002A34000-memory.dmp
memory/4760-6-0x0000000005560000-0x0000000005561000-memory.dmp
memory/4760-7-0x0000000002D40000-0x0000000002D63000-memory.dmp
memory/4760-8-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/4760-9-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/4760-10-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/4760-11-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/4760-12-0x0000000006090000-0x0000000006091000-memory.dmp