Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 18:03
Static task
static1
Behavioral task
behavioral1
Sample
be5006a529a06f16a268bdb477d8878b.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
be5006a529a06f16a268bdb477d8878b.exe
Resource
win10v20210408
General
-
Target
be5006a529a06f16a268bdb477d8878b.exe
-
Size
431KB
-
MD5
be5006a529a06f16a268bdb477d8878b
-
SHA1
7763f470338bf5556cd3f23c3ecababfcd5dd9b1
-
SHA256
6c2fc47191c17a3bef2060481ca8c058336ad27c731b245212364c132081fc2a
-
SHA512
1a80b6018c4ff565d3af3c76eca56fa0aa68cebcdb2affc2793dbdfc8d779a90aaf7f79b25b4b8f1918b4e2f43eb7dd47ad30e4ef06dc7126e26831b34cf9cd4
Malware Config
Extracted
redline
felix2009
213.166.69.181:64650
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1168-120-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/1168-121-0x000000000041C5E2-mapping.dmp family_redline behavioral2/memory/1168-127-0x0000000004F70000-0x0000000005576000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
be5006a529a06f16a268bdb477d8878b.exedescription pid process target process PID 808 set thread context of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
be5006a529a06f16a268bdb477d8878b.exedescription pid process target process PID 808 wrote to memory of 1172 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1172 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1172 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe PID 808 wrote to memory of 1168 808 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe"C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exeC:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exeC:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/808-116-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/808-117-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/808-118-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/808-119-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/1168-120-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1168-121-0x000000000041C5E2-mapping.dmp
-
memory/1168-124-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/1168-125-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/1168-126-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/1168-127-0x0000000004F70000-0x0000000005576000-memory.dmpFilesize
6.0MB
-
memory/1168-128-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1168-129-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB