Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v20210410 - submitted
30/04/2021, 06:07
General
- Target 67fcdd3d71a87c292c4d6711168cac59.exe
- Size 270KB
- Sample210430-3cw22lb4bx
- SHA256 4a67aa2ec300cbb230105e608ae084be8522c0ec84a4f0d265a45efec2d592b3
Malware Config
Extracted
-
redline
-
118
-
bumblebee2021.store:80
-
trusmileveneers.store:80
-
lazerprojekt.store:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67fcdd3d71a87c292c4d6711168cac59.exe"C:\Users\Admin\AppData\Local\Temp\67fcdd3d71a87c292c4d6711168cac59.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4436-114-0x0000000002090000-0x00000000020C0000-memory.dmp
memory/4436-115-0x0000000000400000-0x0000000000460000-memory.dmp
memory/4436-116-0x0000000002390000-0x0000000002391000-memory.dmp
memory/4436-117-0x0000000002120000-0x000000000213E000-memory.dmp
memory/4436-118-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/4436-119-0x0000000002230000-0x000000000224D000-memory.dmp
memory/4436-120-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/4436-121-0x0000000005570000-0x0000000005571000-memory.dmp
memory/4436-122-0x0000000005590000-0x0000000005591000-memory.dmp
memory/4436-123-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/4436-125-0x0000000002393000-0x0000000002394000-memory.dmp
memory/4436-126-0x0000000002394000-0x0000000002396000-memory.dmp
memory/4436-124-0x0000000002392000-0x0000000002393000-memory.dmp
memory/4436-127-0x0000000005780000-0x0000000005781000-memory.dmp