Analysis
- max time kernel
139s - max time network
142s - platform
windows10_x64 - resource
win10v20210410 - submitted
20/07/2021, 12:33
General
- Target e5be7e226866ea3a1b5f753dcec8d5a6.exe
- Size 365KB
- Sample210720-252tyw3as2
- SHA256 2d82513250044d2b18f1e5a264ef0c7ce8d49f80f9cc613dfeb2a54b9839aef1
Malware Config
Extracted
-
redline
-
BOG_2.0
-
45.14.49.91:60919
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5be7e226866ea3a1b5f753dcec8d5a6.exe"C:\Users\Admin\AppData\Local\Temp\e5be7e226866ea3a1b5f753dcec8d5a6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e5be7e226866ea3a1b5f753dcec8d5a6.exeC:\Users\Admin\AppData\Local\Temp\e5be7e226866ea3a1b5f753dcec8d5a6.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1832-118-0x0000000005580000-0x0000000005581000-memory.dmp
memory/1832-117-0x00000000052F0000-0x00000000052F1000-memory.dmp
memory/1832-114-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/1832-116-0x0000000005340000-0x0000000005341000-memory.dmp
memory/2820-119-0x0000000000400000-0x000000000041E000-memory.dmp
memory/2820-124-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/2820-125-0x0000000005330000-0x0000000005331000-memory.dmp
memory/2820-126-0x0000000005390000-0x0000000005391000-memory.dmp
memory/2820-127-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/2820-128-0x0000000005680000-0x0000000005681000-memory.dmp
memory/2820-129-0x00000000052B0000-0x00000000058B6000-memory.dmp