Analysis
- max time kernel
150s - max time network
146s - platform
windows10_x64 - resource
win10v20210410 - submitted
30/04/2021, 05:57
General
- Target d07f237adf5a81069d04206fae9cd4ca.exe
- Size 340KB
- Sample210430-d1eq535mkx
- SHA256 d9219e27e1e17b8a23547ce61a4336cf4dbef85110941198be942ec177b171c7
Malware Config
Extracted
-
redline
-
118
-
bumblebee2021.store:80
-
trusmileveneers.store:80
-
lazerprojekt.store:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d07f237adf5a81069d04206fae9cd4ca.exe"C:\Users\Admin\AppData\Local\Temp\d07f237adf5a81069d04206fae9cd4ca.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3680-114-0x0000000004A20000-0x0000000004A3E000-memory.dmp
memory/3680-115-0x0000000007570000-0x0000000007571000-memory.dmp
memory/3680-116-0x0000000004BD0000-0x0000000004BED000-memory.dmp
memory/3680-117-0x0000000007A70000-0x0000000007A71000-memory.dmp
memory/3680-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/3680-119-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/3680-120-0x0000000005030000-0x0000000005031000-memory.dmp
memory/3680-121-0x0000000002CA0000-0x0000000002CD0000-memory.dmp
memory/3680-123-0x0000000008080000-0x0000000008081000-memory.dmp
memory/3680-122-0x0000000000400000-0x0000000002BC6000-memory.dmp
memory/3680-124-0x0000000007560000-0x0000000007561000-memory.dmp
memory/3680-125-0x0000000007562000-0x0000000007563000-memory.dmp
memory/3680-126-0x0000000007563000-0x0000000007564000-memory.dmp
memory/3680-127-0x0000000007564000-0x0000000007566000-memory.dmp