Analysis
- max time kernel
21s - max time network
103s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/03/2021, 20:57
General
- Target 22716776f02fa6e814a3823bcf59cbb9.exe
- Size 32KB
- Sample210325-bzjgpesdps
- SHA256 d6a0fbce091b5ab48b7e0f7e2cf34cb8e691203e9807d52d021604bfe2e43549
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22716776f02fa6e814a3823bcf59cbb9.exe"C:\Users\Admin\AppData\Local\Temp\22716776f02fa6e814a3823bcf59cbb9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp
memory/648-3-0x0000000000550000-0x0000000000551000-memory.dmp
memory/648-5-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/648-6-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/648-7-0x0000000002730000-0x0000000002731000-memory.dmp
memory/3696-8-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3696-10-0x0000000074000000-0x00000000746EE000-memory.dmp
memory/3696-14-0x0000000005890000-0x0000000005891000-memory.dmp
memory/3696-16-0x0000000006380000-0x0000000006381000-memory.dmp
memory/3696-17-0x0000000005E10000-0x0000000005E11000-memory.dmp
memory/3696-18-0x0000000005E70000-0x0000000005E71000-memory.dmp
memory/3696-19-0x0000000005EB0000-0x0000000005EB1000-memory.dmp
memory/3696-20-0x0000000006110000-0x0000000006111000-memory.dmp
memory/3696-21-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
memory/3696-22-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/3696-23-0x0000000007070000-0x0000000007071000-memory.dmp
memory/3696-24-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/3696-25-0x0000000007110000-0x0000000007111000-memory.dmp
memory/3696-26-0x0000000005891000-0x0000000005892000-memory.dmp
memory/3696-27-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/3696-28-0x0000000008D90000-0x0000000008D91000-memory.dmp