Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/09/2021, 09:56
General
- Target f1605eda6ee89c9d60fc6f3ce0d91724.exe
- Size 426KB
- Sample210922-lyc7macbb7
- SHA256 08e77ab27dbc575f868d1e5bb151fc53ad11a9f25ae39d5cdcf23971568b2e29
Malware Config
Extracted
-
redline
-
build
-
185.244.182.9:56396
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1605eda6ee89c9d60fc6f3ce0d91724.exe"C:\Users\Admin\AppData\Local\Temp\f1605eda6ee89c9d60fc6f3ce0d91724.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1605eda6ee89c9d60fc6f3ce0d91724.exe"C:\Users\Admin\AppData\Local\Temp\f1605eda6ee89c9d60fc6f3ce0d91724.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2168-118-0x00000000050F0000-0x00000000050F3000-memory.dmp
memory/2168-117-0x0000000005180000-0x0000000005181000-memory.dmp
memory/2168-115-0x0000000000750000-0x0000000000751000-memory.dmp
memory/2168-116-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/2168-124-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/2352-119-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2352-126-0x0000000006820000-0x0000000006821000-memory.dmp
memory/2352-128-0x0000000005950000-0x0000000005951000-memory.dmp
memory/2352-129-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
memory/2352-130-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/2352-131-0x00000000066A0000-0x00000000066A1000-memory.dmp
memory/2352-132-0x0000000005810000-0x0000000005D0E000-memory.dmp