Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-04-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
224aaf15b55c7888c9fd3528ce780e38.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
224aaf15b55c7888c9fd3528ce780e38.exe
Resource
win10v20210410
General
-
Target
224aaf15b55c7888c9fd3528ce780e38.exe
-
Size
307KB
-
MD5
224aaf15b55c7888c9fd3528ce780e38
-
SHA1
6174390a87a2cbf12c13d649c293316fecb86ca4
-
SHA256
ca93741ba508ce6c7c159fa0e44a408b370cb1d7791de3ef82c713fb812cc098
-
SHA512
2e02f4d74a1fae27ef33a79b43f3b97fbe1ed3a60a2e8330901e8e84eb8df67c8eb3d135fcf5e9818d9e6e233fdf776279339c3d96ce06c1971efe033615aa84
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1828-62-0x0000000002C60000-0x0000000002C7E000-memory.dmp family_redline behavioral1/memory/1828-66-0x0000000002C90000-0x0000000002CAD000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
224aaf15b55c7888c9fd3528ce780e38.exedescription pid process Token: SeDebugPrivilege 1828 224aaf15b55c7888c9fd3528ce780e38.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-60-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB
-
memory/1828-61-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/1828-62-0x0000000002C60000-0x0000000002C7E000-memory.dmpFilesize
120KB
-
memory/1828-63-0x0000000004981000-0x0000000004982000-memory.dmpFilesize
4KB
-
memory/1828-64-0x0000000004982000-0x0000000004983000-memory.dmpFilesize
4KB
-
memory/1828-65-0x0000000004983000-0x0000000004984000-memory.dmpFilesize
4KB
-
memory/1828-66-0x0000000002C90000-0x0000000002CAD000-memory.dmpFilesize
116KB
-
memory/1828-67-0x0000000004984000-0x0000000004986000-memory.dmpFilesize
8KB