Analysis
-
max time kernel
153s -
max time network
36s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-04-2021 10:21
General
-
Target
0c87f094042b66512fd44d90ed1d1726.exe
-
Size
305KB
-
MD5
0c87f094042b66512fd44d90ed1d1726
-
SHA1
3261db25b39ccc2a3db2ea8ec0fadcfd8eaa67db
-
SHA256
c51f1e9f020fe0dc16af44521de69af76ccc92dead51939965d49ada810a133c
-
SHA512
e9f8b41a5558b0ef3bb81dca1f28b91fdac67c1a5cfc5cff4a79bf1ca456f7b4e1e9a75b036adb5ad39193b1e9910bbf2311beee4d8b644ef92d163badcdef6b
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
118
C2
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c87f094042b66512fd44d90ed1d1726.exe"C:\Users\Admin\AppData\Local\Temp\0c87f094042b66512fd44d90ed1d1726.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1816-60-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1816-61-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/1816-62-0x0000000002C70000-0x0000000002C8E000-memory.dmpFilesize
120KB
-
memory/1816-64-0x00000000070D2000-0x00000000070D3000-memory.dmpFilesize
4KB
-
memory/1816-63-0x00000000070D1000-0x00000000070D2000-memory.dmpFilesize
4KB
-
memory/1816-65-0x00000000070D3000-0x00000000070D4000-memory.dmpFilesize
4KB
-
memory/1816-66-0x0000000002DF0000-0x0000000002E0D000-memory.dmpFilesize
116KB
-
memory/1816-67-0x00000000070D4000-0x00000000070D6000-memory.dmpFilesize
8KB