Analysis
- max time kernel
146s - max time network
158s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/08/2021, 01:11
General
- Target 7362d7d61df9feed1f9fcc4504f524013ee09e3b1a54e.exe
- Size 247KB
- Sample210822-yts46vbc3j
- SHA256 7362d7d61df9feed1f9fcc4504f524013ee09e3b1a54e7c2117d37b88c8a83f3
Malware Config
Extracted
-
redline
-
21.09
-
31.44.3.73:60798
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7362d7d61df9feed1f9fcc4504f524013ee09e3b1a54e.exe"C:\Users\Admin\AppData\Local\Temp\7362d7d61df9feed1f9fcc4504f524013ee09e3b1a54e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-114-0x00000000048C0000-0x00000000048EF000-memory.dmp
memory/656-115-0x0000000000400000-0x0000000002CCC000-memory.dmp
memory/656-116-0x0000000004D50000-0x0000000004D6C000-memory.dmp
memory/656-117-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/656-118-0x0000000004DF0000-0x0000000004E0A000-memory.dmp
memory/656-119-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
memory/656-120-0x0000000007590000-0x0000000007591000-memory.dmp
memory/656-121-0x0000000007592000-0x0000000007593000-memory.dmp
memory/656-122-0x0000000007593000-0x0000000007594000-memory.dmp
memory/656-123-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/656-124-0x0000000007430000-0x0000000007431000-memory.dmp
memory/656-125-0x0000000007594000-0x0000000007596000-memory.dmp
memory/656-126-0x0000000007470000-0x0000000007471000-memory.dmp
memory/656-127-0x0000000008120000-0x0000000008121000-memory.dmp