Overview

overview

10

Static

static

960dabeaba...a6.exe

windows7_x64

10

960dabeaba...a6.exe

windows10_x64

10

Analysis

  • max time kernel
    134s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    05-11-2021 00:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    960dabeaba026a8f3dd5bb4804bbc3a6.exe

  • Size

    283KB

  • MD5

    960dabeaba026a8f3dd5bb4804bbc3a6

  • SHA1

    93d1996201367201272951680da7341d1ba6b0e9

  • SHA256

    1cecdad060bd49501aca8560f70a1dafda7de6d1482a30f18902787ee860c1bd

  • SHA512

    792375ceb92ffd7f78991db711728b146d91a0ef7d36aab102d49915619e5f064689b84c6c24c4f6db2054bbf3987178f3eb15fa50a7fb12a717fa2cb1fb0aec

Score
10/10
redlinekhripinfostealer

Malware Config

Extracted

Family

redline

Botnet

khrip

C2

91.211.251.200:52562

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\960dabeaba026a8f3dd5bb4804bbc3a6.exe
    "C:\Users\Admin\AppData\Local\Temp\960dabeaba026a8f3dd5bb4804bbc3a6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2672-118-0x0000000002330000-0x000000000235D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/2672-119-0x0000000000790000-0x00000000007BB000-memory.dmp
    Filesize

    172KB

    Download
  • memory/2672-120-0x0000000002060000-0x0000000002099000-memory.dmp
    Filesize

    228KB

    Download
  • memory/2672-121-0x0000000000400000-0x0000000000452000-memory.dmp
    Filesize

    328KB

    Download
  • memory/2672-122-0x0000000004B50000-0x0000000004B51000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-123-0x0000000004B60000-0x0000000004B61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-124-0x00000000023D0000-0x00000000023FC000-memory.dmp
    Filesize

    176KB

    Download
  • memory/2672-125-0x0000000005060000-0x0000000005061000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-126-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-127-0x0000000005670000-0x0000000005671000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-128-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-129-0x00000000057B0000-0x00000000057B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-130-0x0000000004B52000-0x0000000004B53000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-131-0x0000000004B53000-0x0000000004B54000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2672-132-0x0000000004B54000-0x0000000004B56000-memory.dmp
    Filesize

    8KB

    Download