Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-04-2021 10:21
Static task
static1
Behavioral task
behavioral1
Sample
0c87f094042b66512fd44d90ed1d1726.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
0c87f094042b66512fd44d90ed1d1726.exe
Resource
win10v20210410
General
-
Target
0c87f094042b66512fd44d90ed1d1726.exe
-
Size
305KB
-
MD5
0c87f094042b66512fd44d90ed1d1726
-
SHA1
3261db25b39ccc2a3db2ea8ec0fadcfd8eaa67db
-
SHA256
c51f1e9f020fe0dc16af44521de69af76ccc92dead51939965d49ada810a133c
-
SHA512
e9f8b41a5558b0ef3bb81dca1f28b91fdac67c1a5cfc5cff4a79bf1ca456f7b4e1e9a75b036adb5ad39193b1e9910bbf2311beee4d8b644ef92d163badcdef6b
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1736-115-0x0000000004A30000-0x0000000004A4E000-memory.dmp family_redline behavioral2/memory/1736-117-0x0000000004CC0000-0x0000000004CDD000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0c87f094042b66512fd44d90ed1d1726.exedescription pid process Token: SeDebugPrivilege 1736 0c87f094042b66512fd44d90ed1d1726.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-114-0x0000000002C10000-0x0000000002CBE000-memory.dmpFilesize
696KB
-
memory/1736-115-0x0000000004A30000-0x0000000004A4E000-memory.dmpFilesize
120KB
-
memory/1736-116-0x0000000007320000-0x0000000007321000-memory.dmpFilesize
4KB
-
memory/1736-117-0x0000000004CC0000-0x0000000004CDD000-memory.dmpFilesize
116KB
-
memory/1736-118-0x0000000007820000-0x0000000007821000-memory.dmpFilesize
4KB
-
memory/1736-119-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/1736-120-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/1736-122-0x0000000007230000-0x0000000007231000-memory.dmpFilesize
4KB
-
memory/1736-121-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/1736-123-0x0000000007314000-0x0000000007316000-memory.dmpFilesize
8KB
-
memory/1736-124-0x0000000007310000-0x0000000007311000-memory.dmpFilesize
4KB
-
memory/1736-125-0x0000000007312000-0x0000000007313000-memory.dmpFilesize
4KB
-
memory/1736-126-0x0000000007313000-0x0000000007314000-memory.dmpFilesize
4KB
-
memory/1736-127-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB