Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-01-2022 16:14
General
-
Target
210adb77fd7478b1a522980371d31a987d43cf536ab8a4e7c8528a70c80aec6c.exe
-
Size
408KB
-
MD5
7e34b34f6742782e8757ee1a6a333b5e
-
SHA1
20510b5bd6bf1f46917db58995b1607bf3760327
-
SHA256
210adb77fd7478b1a522980371d31a987d43cf536ab8a4e7c8528a70c80aec6c
-
SHA512
1a41ff1e869f39e2038c25a51347f67abad42ddbd83c809401f2337a5245243904f6482a7998d19e33edeb321c3e50199a50bf3097b6a492f12ca229e1177a3b
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
noname
C2
185.215.113.29:34865
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\210adb77fd7478b1a522980371d31a987d43cf536ab8a4e7c8528a70c80aec6c.exe"C:\Users\Admin\AppData\Local\Temp\210adb77fd7478b1a522980371d31a987d43cf536ab8a4e7c8528a70c80aec6c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
-
Filesize
228KB
-
Filesize
436KB
-
Filesize
208KB
-
Filesize
5.0MB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
8KB
-
Filesize
300KB