Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe
-
Size
438KB
-
MD5
dcce390d3b1a9046da6cece499782d7d
-
SHA1
669a99f713c35e1851a68bfceff603cc02b9a74a
-
SHA256
c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5
-
SHA512
cbd31d99c68730d520baba0e6d44f1d76c619b73aebb7905fe4a8e621b27ccb994dfa9ab5d4b06d2740b431829b408fdd1423b48c3c49e261c2f47ee603b5bab
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
NONAME
C2
45.9.20.111:1355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3800-116-0x00000000023C0000-0x00000000023F4000-memory.dmp family_redline behavioral1/memory/3800-118-0x0000000004CB0000-0x0000000004CE2000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exedescription pid process Token: SeDebugPrivilege 3800 c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3800-115-0x0000000000890000-0x00000000008D4000-memory.dmpFilesize
272KB
-
memory/3800-116-0x00000000023C0000-0x00000000023F4000-memory.dmpFilesize
208KB
-
memory/3800-117-0x0000000004DE0000-0x00000000052DE000-memory.dmpFilesize
5.0MB
-
memory/3800-118-0x0000000004CB0000-0x0000000004CE2000-memory.dmpFilesize
200KB
-
memory/3800-119-0x0000000002230000-0x0000000002269000-memory.dmpFilesize
228KB
-
memory/3800-120-0x0000000000400000-0x00000000005F5000-memory.dmpFilesize
2.0MB
-
memory/3800-122-0x0000000004DD2000-0x0000000004DD3000-memory.dmpFilesize
4KB
-
memory/3800-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/3800-123-0x0000000004DD3000-0x0000000004DD4000-memory.dmpFilesize
4KB
-
memory/3800-124-0x00000000052E0000-0x00000000058E6000-memory.dmpFilesize
6.0MB
-
memory/3800-125-0x0000000004D70000-0x0000000004D82000-memory.dmpFilesize
72KB
-
memory/3800-126-0x00000000058F0000-0x00000000059FA000-memory.dmpFilesize
1.0MB
-
memory/3800-127-0x0000000005A10000-0x0000000005A4E000-memory.dmpFilesize
248KB
-
memory/3800-128-0x0000000004DD4000-0x0000000004DD6000-memory.dmpFilesize
8KB
-
memory/3800-129-0x0000000005A60000-0x0000000005AAB000-memory.dmpFilesize
300KB