Analysis
- max time kernel
149s - max time network
188s - platform
windows7_x64 - resource
win7v20210408 - submitted
11/06/2021, 14:50
General
- Target 19d88091245e63bd2ee7072470f86f36.exe
- Size 1.7MB
- Sample210611-c1pbc5mel2
- SHA256 dc1a540149dffb968cc641f1770ffb45aaa29f23cd5e19483c474a71cc1737da
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
WHITENEW
C2
-
cengonic.xyz:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-66-0x0000000000400000-0x000000000041E000-memory.dmp
memory/568-68-0x0000000000400000-0x000000000041E000-memory.dmp
memory/568-70-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/1960-60-0x00000000008F0000-0x00000000008F1000-memory.dmp
memory/1960-62-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/1960-63-0x0000000000870000-0x000000000088E000-memory.dmp
memory/1960-64-0x00000000051C0000-0x0000000005221000-memory.dmp
memory/1960-65-0x0000000002180000-0x000000000219F000-memory.dmp