Analysis
- max time kernel
41s - max time network
114s - platform
windows10_x64 - resource
win10v20201028 - submitted
23/03/2021, 08:19
General
- Target 1691693f16e500f8f69002c23ea3fee8.exe
- Size 27KB
- Sample210323-p96cd8pwna
- SHA256 48fa9c51e38f1ddb49c199aa73f2963fa61ffd08656fdebf937818edb4fffee5
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1691693f16e500f8f69002c23ea3fee8.exe"C:\Users\Admin\AppData\Local\Temp\1691693f16e500f8f69002c23ea3fee8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-2-0x0000000073560000-0x0000000073C4E000-memory.dmp
memory/628-3-0x00000000004B0000-0x00000000004B1000-memory.dmp
memory/628-5-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/628-6-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/628-7-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/4020-8-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4020-10-0x0000000073560000-0x0000000073C4E000-memory.dmp
memory/4020-14-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/4020-16-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/4020-17-0x0000000005760000-0x0000000005761000-memory.dmp
memory/4020-18-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/4020-19-0x0000000005800000-0x0000000005801000-memory.dmp
memory/4020-20-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/4020-21-0x00000000067F0000-0x00000000067F1000-memory.dmp
memory/4020-22-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
memory/4020-23-0x00000000069C0000-0x00000000069C1000-memory.dmp
memory/4020-24-0x0000000007920000-0x0000000007921000-memory.dmp
memory/4020-25-0x0000000006A60000-0x0000000006A61000-memory.dmp
memory/4020-26-0x0000000004F11000-0x0000000004F12000-memory.dmp
memory/4020-27-0x0000000006E30000-0x0000000006E31000-memory.dmp
memory/4020-28-0x00000000088E0000-0x00000000088E1000-memory.dmp