Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20210410 - submitted
11/06/2021, 14:50
General
- Target 19d88091245e63bd2ee7072470f86f36.exe
- Size 1.7MB
- Sample210611-c1pbc5mel2
- SHA256 dc1a540149dffb968cc641f1770ffb45aaa29f23cd5e19483c474a71cc1737da
Malware Config
Extracted
-
redline
-
WHITENEW
-
cengonic.xyz:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"C:\Users\Admin\AppData\Local\Temp\19d88091245e63bd2ee7072470f86f36.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1712-126-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1712-135-0x0000000005860000-0x0000000005861000-memory.dmp
memory/1712-134-0x0000000005610000-0x0000000005611000-memory.dmp
memory/1712-133-0x0000000005600000-0x0000000005601000-memory.dmp
memory/1712-132-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/1712-131-0x0000000005560000-0x0000000005561000-memory.dmp
memory/1712-130-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/4036-119-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/4036-124-0x0000000001340000-0x00000000013A1000-memory.dmp
memory/4036-125-0x0000000000FF0000-0x000000000100F000-memory.dmp
memory/4036-123-0x00000000053D0000-0x00000000058CE000-memory.dmp
memory/4036-122-0x00000000058B0000-0x00000000058CE000-memory.dmp
memory/4036-121-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/4036-120-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/4036-114-0x0000000000910000-0x0000000000911000-memory.dmp
memory/4036-118-0x0000000005470000-0x0000000005471000-memory.dmp
memory/4036-117-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/4036-116-0x0000000005300000-0x0000000005301000-memory.dmp