Analysis
-
max time kernel
150s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-04-2021 11:03
General
-
Target
0c87f094042b66512fd44d90ed1d1726.exe
-
Size
305KB
-
MD5
0c87f094042b66512fd44d90ed1d1726
-
SHA1
3261db25b39ccc2a3db2ea8ec0fadcfd8eaa67db
-
SHA256
c51f1e9f020fe0dc16af44521de69af76ccc92dead51939965d49ada810a133c
-
SHA512
e9f8b41a5558b0ef3bb81dca1f28b91fdac67c1a5cfc5cff4a79bf1ca456f7b4e1e9a75b036adb5ad39193b1e9910bbf2311beee4d8b644ef92d163badcdef6b
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
118
C2
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c87f094042b66512fd44d90ed1d1726.exe"C:\Users\Admin\AppData\Local\Temp\0c87f094042b66512fd44d90ed1d1726.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/452-60-0x00000000002D0000-0x0000000000300000-memory.dmpFilesize
192KB
-
memory/452-61-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/452-62-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/452-63-0x0000000004550000-0x000000000456D000-memory.dmpFilesize
116KB
-
memory/452-66-0x00000000071A3000-0x00000000071A4000-memory.dmpFilesize
4KB
-
memory/452-67-0x00000000071A4000-0x00000000071A6000-memory.dmpFilesize
8KB
-
memory/452-65-0x00000000071A2000-0x00000000071A3000-memory.dmpFilesize
4KB
-
memory/452-64-0x00000000071A1000-0x00000000071A2000-memory.dmpFilesize
4KB