Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-04-2021 14:37
Static task
static1
Behavioral task
behavioral1
Sample
d69e7465ee7a39d7149d5150b79c8403.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d69e7465ee7a39d7149d5150b79c8403.exe
Resource
win10v20210408
General
-
Target
d69e7465ee7a39d7149d5150b79c8403.exe
-
Size
314KB
-
MD5
d69e7465ee7a39d7149d5150b79c8403
-
SHA1
e8f7af0707f03e076e62c4936843a60695c1dc26
-
SHA256
3402ccadc0caee011653d08f4c1da3c2c55fa27f0960e0e1ae83a30dda9dc472
-
SHA512
f9678c1778f3a0b393f233e1f2ac48f05c170088598857fa863151e369e912e3b17c2c6a6d5edff9c8e56e648973cc15649117cb528e7bbd1876e5a88b0e091e
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1032-116-0x0000000002460000-0x000000000247E000-memory.dmp family_redline behavioral2/memory/1032-121-0x00000000025F0000-0x000000000260D000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d69e7465ee7a39d7149d5150b79c8403.exedescription pid process Token: SeDebugPrivilege 1032 d69e7465ee7a39d7149d5150b79c8403.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-114-0x0000000000650000-0x0000000000680000-memory.dmpFilesize
192KB
-
memory/1032-115-0x0000000000400000-0x00000000004BB000-memory.dmpFilesize
748KB
-
memory/1032-116-0x0000000002460000-0x000000000247E000-memory.dmpFilesize
120KB
-
memory/1032-117-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/1032-119-0x0000000004D42000-0x0000000004D43000-memory.dmpFilesize
4KB
-
memory/1032-118-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/1032-120-0x0000000004D43000-0x0000000004D44000-memory.dmpFilesize
4KB
-
memory/1032-121-0x00000000025F0000-0x000000000260D000-memory.dmpFilesize
116KB
-
memory/1032-122-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1032-123-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/1032-124-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1032-125-0x0000000004D44000-0x0000000004D46000-memory.dmpFilesize
8KB
-
memory/1032-126-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/1032-127-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB