Analysis
- max time kernel
139s - max time network
153s - platform
windows10_x64 - resource
win10-en - submitted
19/09/2021, 16:49
General
- Target 96ff8ba929c9de23b8c3aaafd9e32165.exe
- Size 432KB
- Sample210919-vbnvaaehck
- SHA256 d5a7c6129c06b47ea91b7f93b0f3f424cfa641e6afbd6ceb95e559850270fd22
Malware Config
Extracted
-
redline
-
louise14
-
193.188.21.209:41939
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exe"C:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exeC:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exeC:\Users\Admin\AppData\Local\Temp\96ff8ba929c9de23b8c3aaafd9e32165.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3628-127-0x0000000003180000-0x0000000003181000-memory.dmp
memory/3628-121-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3628-126-0x0000000005D20000-0x0000000005D21000-memory.dmp
memory/3628-128-0x0000000005820000-0x0000000005821000-memory.dmp
memory/3628-129-0x0000000005750000-0x0000000005751000-memory.dmp
memory/3628-130-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3628-131-0x0000000005710000-0x0000000005D16000-memory.dmp
memory/3992-118-0x0000000004920000-0x0000000004921000-memory.dmp
memory/3992-119-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/3992-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/3992-117-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/3992-115-0x0000000000130000-0x0000000000131000-memory.dmp