redline | 81a4dac1ab9667222cc1f0fc9808336f6888b2827ced5e396ec1dc85bd800bec

Analysis

max time kernel
143s
max time network
146s
platform
windows10_x64
resource
win10v20201028
submitted
15-02-2021 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

income.exe
Size

265KB
MD5

cc26446687908c70c0f83a1f7690998a
SHA1

43ba0b210618a010474580efa48f64fc50aed0f3
SHA256

81a4dac1ab9667222cc1f0fc9808336f6888b2827ced5e396ec1dc85bd800bec
SHA512

a283c8239a5a177f1df318a0a7ef61a6a4e3a57d2d076e1ab9fca27422d4ede54cc997709fda1ce36d678a412942e449b8ec146bb1acd88784ec5e2e621d66f5

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4764-7-0x00000000026B0000-0x00000000026DC000-memory.dmp	family_redline
behavioral2/memory/4764-9-0x00000000029C0000-0x00000000029EA000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

income.exe

description pid process

Token: SeDebugPrivilege 4764 income.exe

description	pid	process
Token: SeDebugPrivilege	4764	income.exe

C:\Users\Admin\AppData\Local\Temp\income.exe
"C:\Users\Admin\AppData\Local\Temp\income.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-2-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/4764-3-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/4764-4-0x00000000008E0000-0x0000000000916000-memory.dmp

Filesize
216KB

Download
memory/4764-5-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4764-6-0x00000000731A0000-0x000000007388E000-memory.dmp

Filesize
6.9MB

Download
memory/4764-7-0x00000000026B0000-0x00000000026DC000-memory.dmp

Filesize
176KB

Download
memory/4764-8-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4764-9-0x00000000029C0000-0x00000000029EA000-memory.dmp

Filesize
168KB

Download
memory/4764-10-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/4764-11-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/4764-13-0x0000000002CC2000-0x0000000002CC3000-memory.dmp

Filesize
4KB

Download
memory/4764-12-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Filesize
4KB

Download
memory/4764-14-0x0000000002CC3000-0x0000000002CC4000-memory.dmp

Filesize
4KB

Download
memory/4764-15-0x0000000002CC4000-0x0000000002CC6000-memory.dmp

Filesize
8KB

Download
memory/4764-16-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/4764-17-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/4764-18-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/4764-19-0x0000000005D10000-0x0000000005D11000-memory.dmp

Filesize
4KB

Download
memory/4764-20-0x0000000005E60000-0x0000000005E61000-memory.dmp

Filesize
4KB

Download