Analysis
- max time kernel
145s - max time network
159s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/06/2021, 07:42
General
- Target 3a09a05ada813de6661be5739dc3c0c9.exe
- Size 388KB
- Sample210601-eykhssp24a
- SHA256 e87c87c4a26902bc8bbd9993162a98bfb67bb20f9b06cfc0084f5301bec9b816
Malware Config
Extracted
-
redline
-
iNerino
-
49.12.42.196:23783
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a09a05ada813de6661be5739dc3c0c9.exe"C:\Users\Admin\AppData\Local\Temp\3a09a05ada813de6661be5739dc3c0c9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/796-114-0x00000000021A0000-0x00000000021B9000-memory.dmp
memory/796-115-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/796-116-0x0000000002600000-0x0000000002617000-memory.dmp
memory/796-117-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/796-118-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/796-119-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/796-120-0x0000000002080000-0x00000000020AE000-memory.dmp
memory/796-121-0x0000000000400000-0x0000000000469000-memory.dmp
memory/796-122-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/796-123-0x0000000004B92000-0x0000000004B93000-memory.dmp
memory/796-124-0x0000000004B93000-0x0000000004B94000-memory.dmp
memory/796-125-0x0000000005740000-0x0000000005741000-memory.dmp
memory/796-126-0x0000000004B94000-0x0000000004B96000-memory.dmp
memory/796-127-0x00000000058D0000-0x00000000058D1000-memory.dmp