Analysis
- max time kernel
150s - max time network
158s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/06/2021, 12:22
General
- Target 371214155b717736c9313d96381cb3a3.exe
- Size 378KB
- Sample210619-bxyms1exmx
- SHA256 11fe9d8d9ceef4a2f973bbc1076c5c6927b6d854510f0ed499b0eb93ff31e7ba
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\371214155b717736c9313d96381cb3a3.exe"C:\Users\Admin\AppData\Local\Temp\371214155b717736c9313d96381cb3a3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3008-114-0x0000000000B90000-0x0000000000BBF000-memory.dmp
memory/3008-115-0x0000000000400000-0x00000000008FD000-memory.dmp
memory/3008-116-0x0000000002730000-0x000000000274B000-memory.dmp
memory/3008-117-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/3008-118-0x0000000002AA0000-0x0000000002AB9000-memory.dmp
memory/3008-120-0x00000000052D2000-0x00000000052D3000-memory.dmp
memory/3008-119-0x00000000052D0000-0x00000000052D1000-memory.dmp
memory/3008-121-0x00000000052D3000-0x00000000052D4000-memory.dmp
memory/3008-122-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/3008-123-0x00000000052D4000-0x00000000052D6000-memory.dmp
memory/3008-124-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/3008-125-0x0000000002C00000-0x0000000002C01000-memory.dmp
memory/3008-126-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/3008-127-0x0000000005DF0000-0x0000000005DF1000-memory.dmp
memory/3008-128-0x0000000006940000-0x0000000006941000-memory.dmp
memory/3008-129-0x0000000006B10000-0x0000000006B11000-memory.dmp