redline | ddd810853f9fa4626060db340eaf5c38b614b81be0dc05f92c0f5356431bc9c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
18-02-2021 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30073d7cc81768ddd8e3bb1b08b9f144.exe
Size

428KB
MD5

30073d7cc81768ddd8e3bb1b08b9f144
SHA1

439eb4d721bd814b04598890736685506a5bfcf1
SHA256

ddd810853f9fa4626060db340eaf5c38b614b81be0dc05f92c0f5356431bc9c5
SHA512

b90a32f870794b5e0f979774c16ee333ab032d24508a38949ddae095f87b7eb2754e3f84b8f1c234cbb219ea436ffea3e2da3d0379b9c9b7434df5b64039252a

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4772-5-0x0000000003070000-0x000000000309C000-memory.dmp	family_redline
behavioral2/memory/4772-12-0x0000000004BE0000-0x0000000004C0A000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

30073d7cc81768ddd8e3bb1b08b9f144.exe

description pid process

Token: SeDebugPrivilege 4772 30073d7cc81768ddd8e3bb1b08b9f144.exe

description	pid	process
Token: SeDebugPrivilege	4772	30073d7cc81768ddd8e3bb1b08b9f144.exe

C:\Users\Admin\AppData\Local\Temp\30073d7cc81768ddd8e3bb1b08b9f144.exe
"C:\Users\Admin\AppData\Local\Temp\30073d7cc81768ddd8e3bb1b08b9f144.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-2-0x00000000030B0000-0x00000000030B1000-memory.dmp

Filesize
4KB

Download
memory/4772-3-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/4772-4-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/4772-5-0x0000000003070000-0x000000000309C000-memory.dmp

Filesize
176KB

Download
memory/4772-6-0x0000000002BF0000-0x0000000002C26000-memory.dmp

Filesize
216KB

Download
memory/4772-7-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4772-8-0x0000000007302000-0x0000000007303000-memory.dmp

Filesize
4KB

Download
memory/4772-9-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/4772-10-0x0000000007303000-0x0000000007304000-memory.dmp

Filesize
4KB

Download
memory/4772-11-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/4772-12-0x0000000004BE0000-0x0000000004C0A000-memory.dmp

Filesize
168KB

Download
memory/4772-13-0x0000000007220000-0x0000000007221000-memory.dmp

Filesize
4KB

Download
memory/4772-14-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/4772-15-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/4772-16-0x0000000007E60000-0x0000000007E61000-memory.dmp

Filesize
4KB

Download
memory/4772-17-0x0000000007E80000-0x0000000007E81000-memory.dmp

Filesize
4KB

Download
memory/4772-18-0x0000000007304000-0x0000000007306000-memory.dmp

Filesize
8KB

Download
memory/4772-19-0x0000000007FF0000-0x0000000007FF1000-memory.dmp

Filesize
4KB

Download
memory/4772-20-0x0000000008170000-0x0000000008171000-memory.dmp

Filesize
4KB

Download