Analysis
- max time kernel
66s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/03/2021, 08:29
General
- Target d4de52961412050e62792ce350b7db75.exe
- Size 1.3MB
- Sample210325-31clnacly6
- SHA256 83836ff69fc304d684edf3d394d45f0d2a8755a4de2d0fd6b06261ffe9336ed7
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4de52961412050e62792ce350b7db75.exe"C:\Users\Admin\AppData\Local\Temp\d4de52961412050e62792ce350b7db75.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-2-0x0000000073AD0000-0x00000000741BE000-memory.dmp
memory/496-3-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/496-5-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/496-6-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/496-7-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/496-8-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/496-9-0x0000000005230000-0x0000000005235000-memory.dmp
memory/496-10-0x0000000008610000-0x0000000008611000-memory.dmp
memory/496-11-0x00000000088A0000-0x000000000893F000-memory.dmp
memory/496-12-0x000000000AF40000-0x000000000AFAE000-memory.dmp
memory/2216-13-0x0000000000400000-0x0000000000436000-memory.dmp
memory/2216-15-0x0000000073AD0000-0x00000000741BE000-memory.dmp
memory/2216-18-0x0000000005250000-0x0000000005251000-memory.dmp
memory/2216-19-0x0000000005460000-0x0000000005461000-memory.dmp
memory/2216-20-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2216-21-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/2216-22-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/2216-23-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/2216-24-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/2216-25-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/2216-26-0x0000000006BA0000-0x0000000006BA1000-memory.dmp
memory/2216-27-0x00000000072A0000-0x00000000072A1000-memory.dmp
memory/2216-30-0x0000000006E10000-0x0000000006E11000-memory.dmp
memory/2216-31-0x0000000005461000-0x0000000005462000-memory.dmp
memory/2216-32-0x0000000005840000-0x0000000005841000-memory.dmp