Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-02-2021 18:51
Static task
static1
Behavioral task
behavioral1
Sample
income.exe
Resource
win7v20201028
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
income.exe
Resource
win10v20201028
0 signatures
0 seconds
General
-
Target
income.exe
-
Size
265KB
-
MD5
cc26446687908c70c0f83a1f7690998a
-
SHA1
43ba0b210618a010474580efa48f64fc50aed0f3
-
SHA256
81a4dac1ab9667222cc1f0fc9808336f6888b2827ced5e396ec1dc85bd800bec
-
SHA512
a283c8239a5a177f1df318a0a7ef61a6a4e3a57d2d076e1ab9fca27422d4ede54cc997709fda1ce36d678a412942e449b8ec146bb1acd88784ec5e2e621d66f5
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-7-0x00000000026B0000-0x00000000026DC000-memory.dmp family_redline behavioral2/memory/4764-9-0x00000000029C0000-0x00000000029EA000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
income.exedescription pid process Token: SeDebugPrivilege 4764 income.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4764-2-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/4764-3-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/4764-4-0x00000000008E0000-0x0000000000916000-memory.dmpFilesize
216KB
-
memory/4764-5-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4764-6-0x00000000731A0000-0x000000007388E000-memory.dmpFilesize
6.9MB
-
memory/4764-7-0x00000000026B0000-0x00000000026DC000-memory.dmpFilesize
176KB
-
memory/4764-8-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4764-9-0x00000000029C0000-0x00000000029EA000-memory.dmpFilesize
168KB
-
memory/4764-10-0x00000000029F0000-0x00000000029F1000-memory.dmpFilesize
4KB
-
memory/4764-11-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/4764-13-0x0000000002CC2000-0x0000000002CC3000-memory.dmpFilesize
4KB
-
memory/4764-12-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB
-
memory/4764-14-0x0000000002CC3000-0x0000000002CC4000-memory.dmpFilesize
4KB
-
memory/4764-15-0x0000000002CC4000-0x0000000002CC6000-memory.dmpFilesize
8KB
-
memory/4764-16-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/4764-17-0x0000000002CF0000-0x0000000002CF1000-memory.dmpFilesize
4KB
-
memory/4764-18-0x0000000002D10000-0x0000000002D11000-memory.dmpFilesize
4KB
-
memory/4764-19-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/4764-20-0x0000000005E60000-0x0000000005E61000-memory.dmpFilesize
4KB