Overview

overview

10

Static

static

14e44f4978...30.exe

windows7_x64

10

14e44f4978...30.exe

windows10_x64

10

Analysis

  • max time kernel
    48s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    19-02-2021 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14e44f49785c8ded87796a6da24f7130.exe

  • Size

    638KB

  • MD5

    14e44f49785c8ded87796a6da24f7130

  • SHA1

    3e33b7b9c9fe6d2f7b7989d30ea0eb710fac9abe

  • SHA256

    002169163197e9a6fbe52c9d5cad8e901e52613d2ff4efbe2ccac367cea51af9

  • SHA512

    4c43222fe7c6ae101a767ffac21ca70654e95b5f774f89522a3fee2a1f4a1f2530797d3b9d65e2167e0bcd73844b47c941189facdd08101ead00bb7992437ae7

Score
10/10
redlineinfostealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14e44f49785c8ded87796a6da24f7130.exe
    "C:\Users\Admin\AppData\Local\Temp\14e44f49785c8ded87796a6da24f7130.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1388-7-0x0000000000400000-0x0000000000426000-memory.dmp
    Filesize

    152KB

    Download
  • memory/1388-8-0x000000000041EFD6-mapping.dmp
    Download
  • memory/1388-9-0x0000000074640000-0x0000000074D2E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1388-10-0x0000000000400000-0x0000000000426000-memory.dmp
    Filesize

    152KB

    Download
  • memory/1388-12-0x00000000047B0000-0x00000000047B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1656-2-0x0000000074640000-0x0000000074D2E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1656-3-0x0000000000130000-0x0000000000131000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1656-5-0x0000000004D00000-0x0000000004D01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1656-6-0x0000000000890000-0x00000000008A7000-memory.dmp
    Filesize

    92KB

    Download