Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-04-2021 05:57
Static task
static1
Behavioral task
behavioral1
Sample
d07f237adf5a81069d04206fae9cd4ca.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
d07f237adf5a81069d04206fae9cd4ca.exe
Resource
win10v20210410
General
-
Target
d07f237adf5a81069d04206fae9cd4ca.exe
-
Size
340KB
-
MD5
d07f237adf5a81069d04206fae9cd4ca
-
SHA1
11c9153b58a395fc05045986935ad7c9dac25ef7
-
SHA256
d9219e27e1e17b8a23547ce61a4336cf4dbef85110941198be942ec177b171c7
-
SHA512
4adb859fbd8ffcf073e0f76b14479f16b9cbef90a279e2337fb15cf42444d6671a86592199066112856c09c174c3a6f0a98d769c56a80b3a00bd11589a47e541
Malware Config
Extracted
redline
118
bumblebee2021.store:80
trusmileveneers.store:80
lazerprojekt.store:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3680-114-0x0000000004A20000-0x0000000004A3E000-memory.dmp family_redline behavioral2/memory/3680-116-0x0000000004BD0000-0x0000000004BED000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d07f237adf5a81069d04206fae9cd4ca.exedescription pid process Token: SeDebugPrivilege 3680 d07f237adf5a81069d04206fae9cd4ca.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3680-114-0x0000000004A20000-0x0000000004A3E000-memory.dmpFilesize
120KB
-
memory/3680-115-0x0000000007570000-0x0000000007571000-memory.dmpFilesize
4KB
-
memory/3680-116-0x0000000004BD0000-0x0000000004BED000-memory.dmpFilesize
116KB
-
memory/3680-117-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/3680-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/3680-119-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/3680-120-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3680-121-0x0000000002CA0000-0x0000000002CD0000-memory.dmpFilesize
192KB
-
memory/3680-123-0x0000000008080000-0x0000000008081000-memory.dmpFilesize
4KB
-
memory/3680-122-0x0000000000400000-0x0000000002BC6000-memory.dmpFilesize
39.8MB
-
memory/3680-124-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/3680-125-0x0000000007562000-0x0000000007563000-memory.dmpFilesize
4KB
-
memory/3680-126-0x0000000007563000-0x0000000007564000-memory.dmpFilesize
4KB
-
memory/3680-127-0x0000000007564000-0x0000000007566000-memory.dmpFilesize
8KB