Analysis

  • max time kernel
    13s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08-04-2021 07:06

General

  • Target

    E4B9EABED5C9379746E079454788C0E5.exe

  • Size

    128KB

  • MD5

    e4b9eabed5c9379746e079454788c0e5

  • SHA1

    f4b1b2ca30865a0e86a6e2ddf6de4f9bcfcfb057

  • SHA256

    17c12556d3a9b99d40a6f974ead1f46817c2cd55f91aae87bd564383b6b32382

  • SHA512

    190b161bb45b05ea625671aeaabf0521234671bfe73afcd5969e373dd8847ce8c35a2786bcfeb87f8035246a8a25f340f9f37060ecbd509fb3c36b772868119c

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E4B9EABED5C9379746E079454788C0E5.exe
    "C:\Users\Admin\AppData\Local\Temp\E4B9EABED5C9379746E079454788C0E5.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1656-2-0x0000000074640000-0x0000000074D2E000-memory.dmp
    Filesize

    6.9MB

  • memory/1656-3-0x0000000000940000-0x0000000000941000-memory.dmp
    Filesize

    4KB

  • memory/1656-5-0x0000000004910000-0x0000000004911000-memory.dmp
    Filesize

    4KB