Analysis
-
max time kernel
153s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-03-2021 19:34
Static task
static1
Behavioral task
behavioral1
Sample
ec8b389edf6738f9b561418f4b0b0d9c.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ec8b389edf6738f9b561418f4b0b0d9c.exe
Resource
win10v20201028
General
-
Target
ec8b389edf6738f9b561418f4b0b0d9c.exe
-
Size
159KB
-
MD5
ec8b389edf6738f9b561418f4b0b0d9c
-
SHA1
b0047154ae3e3626ca02a54ee315fdec7a1656b7
-
SHA256
14ed09b6cec2b4465de883ce16001c309436f916fb1d3b84d41f84e39f4712ed
-
SHA512
f75d26c333fb14d06a0537e2a5adb023d71d91724f75795c795e916f8b5a7fa2050204febe361c54245462c633a15badbf886b9e30bf3e2e337e3b9338480029
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3256-13-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral2/memory/3256-14-0x000000000041EFD2-mapping.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ec8b389edf6738f9b561418f4b0b0d9c.exedescription pid process target process PID 3996 set thread context of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ec8b389edf6738f9b561418f4b0b0d9c.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe Token: SeDebugPrivilege 3256 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ec8b389edf6738f9b561418f4b0b0d9c.exedescription pid process target process PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe PID 3996 wrote to memory of 3256 3996 ec8b389edf6738f9b561418f4b0b0d9c.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec8b389edf6738f9b561418f4b0b0d9c.exe"C:\Users\Admin\AppData\Local\Temp\ec8b389edf6738f9b561418f4b0b0d9c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3256-13-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3256-25-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3256-24-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/3256-23-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/3256-22-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/3256-21-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/3256-20-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/3256-15-0x00000000738B0000-0x0000000073F9E000-memory.dmpFilesize
6.9MB
-
memory/3256-14-0x000000000041EFD2-mapping.dmp
-
memory/3996-8-0x0000000004A12000-0x0000000004A13000-memory.dmpFilesize
4KB
-
memory/3996-12-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/3996-11-0x0000000004A14000-0x0000000004A16000-memory.dmpFilesize
8KB
-
memory/3996-10-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/3996-9-0x0000000004A13000-0x0000000004A14000-memory.dmpFilesize
4KB
-
memory/3996-7-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/3996-2-0x0000000002240000-0x0000000002241000-memory.dmpFilesize
4KB
-
memory/3996-6-0x0000000004A00000-0x0000000004A0C000-memory.dmpFilesize
48KB
-
memory/3996-5-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3996-4-0x0000000002220000-0x000000000222D000-memory.dmpFilesize
52KB
-
memory/3996-3-0x00000000738B0000-0x0000000073F9E000-memory.dmpFilesize
6.9MB