Analysis
- max time kernel
131s - max time network
134s - platform
windows10_x64 - resource
win10v20210410 - submitted
21/06/2021, 07:06
General
- Target 8f8ea294d5df1ec9cb1f6bbe545a39eb.exe
- Size 398KB
- Sample210621-fvdagf2fse
- SHA256 33d32be47c6fe9ec4b94d7f7bfb5381fdb6854c8f2a74ea91e8583035b8a592c
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f8ea294d5df1ec9cb1f6bbe545a39eb.exe"C:\Users\Admin\AppData\Local\Temp\8f8ea294d5df1ec9cb1f6bbe545a39eb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3924-114-0x0000000002740000-0x000000000275B000-memory.dmp
memory/3924-115-0x0000000005240000-0x0000000005241000-memory.dmp
memory/3924-116-0x0000000002C10000-0x0000000002C29000-memory.dmp
memory/3924-117-0x0000000005740000-0x0000000005741000-memory.dmp
memory/3924-118-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/3924-119-0x0000000002650000-0x000000000267F000-memory.dmp
memory/3924-121-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/3924-120-0x0000000000400000-0x0000000000902000-memory.dmp
memory/3924-122-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/3924-123-0x0000000002C92000-0x0000000002C93000-memory.dmp
memory/3924-124-0x0000000002C93000-0x0000000002C94000-memory.dmp
memory/3924-125-0x0000000002C94000-0x0000000002C96000-memory.dmp
memory/3924-126-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/3924-127-0x0000000005D60000-0x0000000005D61000-memory.dmp