Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-04-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
3a25a3b49aebc374d28e83c4f7a07ebb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
3a25a3b49aebc374d28e83c4f7a07ebb.exe
Resource
win10v20210408
General
-
Target
3a25a3b49aebc374d28e83c4f7a07ebb.exe
-
Size
324KB
-
MD5
3a25a3b49aebc374d28e83c4f7a07ebb
-
SHA1
b768494e7a8044be336247de62c90d893a4cac2e
-
SHA256
dfbbd4b5c26f2cde1082d54c490c3f13ee8510e3223c9d07c52910568a2948d7
-
SHA512
9fb6d78bafd34e861a5e66755c1d58e6bd6744d51ddac6a47e2b87c7383edb3cd2935834b3cb686d821e1f6c987d60ae460b884a85976862c3f990effd9ba4af
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4656-116-0x0000000002410000-0x000000000242E000-memory.dmp family_redline behavioral2/memory/4656-121-0x0000000004B00000-0x0000000004B1D000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3a25a3b49aebc374d28e83c4f7a07ebb.exedescription pid process Token: SeDebugPrivilege 4656 3a25a3b49aebc374d28e83c4f7a07ebb.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4656-114-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/4656-115-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4656-116-0x0000000002410000-0x000000000242E000-memory.dmpFilesize
120KB
-
memory/4656-117-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4656-119-0x0000000004C03000-0x0000000004C04000-memory.dmpFilesize
4KB
-
memory/4656-118-0x0000000004C02000-0x0000000004C03000-memory.dmpFilesize
4KB
-
memory/4656-120-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/4656-121-0x0000000004B00000-0x0000000004B1D000-memory.dmpFilesize
116KB
-
memory/4656-122-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4656-123-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/4656-124-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/4656-125-0x0000000004C04000-0x0000000004C06000-memory.dmpFilesize
8KB
-
memory/4656-126-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/4656-127-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB