Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-04-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
224aaf15b55c7888c9fd3528ce780e38.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
224aaf15b55c7888c9fd3528ce780e38.exe
Resource
win10v20210410
General
-
Target
224aaf15b55c7888c9fd3528ce780e38.exe
-
Size
307KB
-
MD5
224aaf15b55c7888c9fd3528ce780e38
-
SHA1
6174390a87a2cbf12c13d649c293316fecb86ca4
-
SHA256
ca93741ba508ce6c7c159fa0e44a408b370cb1d7791de3ef82c713fb812cc098
-
SHA512
2e02f4d74a1fae27ef33a79b43f3b97fbe1ed3a60a2e8330901e8e84eb8df67c8eb3d135fcf5e9818d9e6e233fdf776279339c3d96ce06c1971efe033615aa84
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2208-114-0x0000000004A30000-0x0000000004A4E000-memory.dmp family_redline behavioral2/memory/2208-116-0x0000000004AF0000-0x0000000004B0D000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
224aaf15b55c7888c9fd3528ce780e38.exedescription pid process Token: SeDebugPrivilege 2208 224aaf15b55c7888c9fd3528ce780e38.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2208-114-0x0000000004A30000-0x0000000004A4E000-memory.dmpFilesize
120KB
-
memory/2208-115-0x00000000072F0000-0x00000000072F1000-memory.dmpFilesize
4KB
-
memory/2208-116-0x0000000004AF0000-0x0000000004B0D000-memory.dmpFilesize
116KB
-
memory/2208-117-0x00000000077F0000-0x00000000077F1000-memory.dmpFilesize
4KB
-
memory/2208-118-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/2208-119-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/2208-120-0x0000000002C60000-0x0000000002D0E000-memory.dmpFilesize
696KB
-
memory/2208-122-0x0000000007230000-0x0000000007231000-memory.dmpFilesize
4KB
-
memory/2208-121-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/2208-123-0x00000000072E4000-0x00000000072E6000-memory.dmpFilesize
8KB
-
memory/2208-124-0x00000000072E0000-0x00000000072E1000-memory.dmpFilesize
4KB
-
memory/2208-125-0x00000000072E2000-0x00000000072E3000-memory.dmpFilesize
4KB
-
memory/2208-126-0x00000000072E3000-0x00000000072E4000-memory.dmpFilesize
4KB
-
memory/2208-127-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB