Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-02-2021 18:51
General
-
Target
income.exe
-
Size
265KB
-
MD5
cc26446687908c70c0f83a1f7690998a
-
SHA1
43ba0b210618a010474580efa48f64fc50aed0f3
-
SHA256
81a4dac1ab9667222cc1f0fc9808336f6888b2827ced5e396ec1dc85bd800bec
-
SHA512
a283c8239a5a177f1df318a0a7ef61a6a4e3a57d2d076e1ab9fca27422d4ede54cc997709fda1ce36d678a412942e449b8ec146bb1acd88784ec5e2e621d66f5
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\income.exe"C:\Users\Admin\AppData\Local\Temp\income.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-2-0x0000000000B00000-0x0000000000B11000-memory.dmpFilesize
68KB
-
memory/544-3-0x0000000002400000-0x0000000002411000-memory.dmpFilesize
68KB
-
memory/544-4-0x0000000074950000-0x000000007503E000-memory.dmpFilesize
6.9MB
-
memory/544-5-0x00000000023B0000-0x00000000023DC000-memory.dmpFilesize
176KB
-
memory/544-11-0x0000000000270000-0x00000000002A6000-memory.dmpFilesize
216KB
-
memory/544-13-0x0000000004DC1000-0x0000000004DC2000-memory.dmpFilesize
4KB
-
memory/544-15-0x0000000004DC3000-0x0000000004DC4000-memory.dmpFilesize
4KB
-
memory/544-14-0x0000000004DC2000-0x0000000004DC3000-memory.dmpFilesize
4KB
-
memory/544-12-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/544-16-0x0000000002400000-0x000000000242A000-memory.dmpFilesize
168KB
-
memory/544-17-0x0000000004DC4000-0x0000000004DC6000-memory.dmpFilesize
8KB