Analysis
- max time kernel
90s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
16/03/2021, 18:17
General
- Target ac2449dff42de275b914e70a40d221ad.exe
- Size 424KB
- Sample210316-2chdnafm6n
- SHA256 369e3c4b6730652146d275cd3db45eaa369c25fcaad3b11cdd3844878193768e
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac2449dff42de275b914e70a40d221ad.exe"C:\Users\Admin\AppData\Local\Temp\ac2449dff42de275b914e70a40d221ad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-2-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/496-3-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/496-5-0x0000000000400000-0x000000000043A000-memory.dmp
memory/496-4-0x0000000002FA0000-0x0000000002FD7000-memory.dmp
memory/496-6-0x0000000073230000-0x000000007391E000-memory.dmp
memory/496-7-0x0000000004920000-0x000000000494E000-memory.dmp
memory/496-9-0x0000000007422000-0x0000000007423000-memory.dmp
memory/496-8-0x0000000007420000-0x0000000007421000-memory.dmp
memory/496-10-0x0000000007430000-0x0000000007431000-memory.dmp
memory/496-11-0x0000000004D60000-0x0000000004D8C000-memory.dmp
memory/496-12-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/496-13-0x0000000007423000-0x0000000007424000-memory.dmp
memory/496-14-0x0000000007424000-0x0000000007426000-memory.dmp
memory/496-15-0x0000000007CF0000-0x0000000007CF1000-memory.dmp
memory/496-16-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
memory/496-17-0x0000000008550000-0x0000000008551000-memory.dmp
memory/496-18-0x0000000008570000-0x0000000008571000-memory.dmp
memory/496-19-0x00000000086E0000-0x00000000086E1000-memory.dmp
memory/496-20-0x0000000008860000-0x0000000008861000-memory.dmp