Analysis
- max time kernel
135s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
21/01/2022, 02:18
General
- Target c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe
- Size 438KB
- Sample220121-crcg3sdae7
- SHA256 c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5
Malware Config
Extracted
-
redline
-
NONAME
-
45.9.20.111:1355
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe"C:\Users\Admin\AppData\Local\Temp\c8aff7875b4cb18ab32a25ae82f9cdb35229b30232cab6c8bb835bd4c62c34f5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3800-115-0x0000000000890000-0x00000000008D4000-memory.dmp
memory/3800-116-0x00000000023C0000-0x00000000023F4000-memory.dmp
memory/3800-117-0x0000000004DE0000-0x00000000052DE000-memory.dmp
memory/3800-118-0x0000000004CB0000-0x0000000004CE2000-memory.dmp
memory/3800-119-0x0000000002230000-0x0000000002269000-memory.dmp
memory/3800-120-0x0000000000400000-0x00000000005F5000-memory.dmp
memory/3800-122-0x0000000004DD2000-0x0000000004DD3000-memory.dmp
memory/3800-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/3800-123-0x0000000004DD3000-0x0000000004DD4000-memory.dmp
memory/3800-124-0x00000000052E0000-0x00000000058E6000-memory.dmp
memory/3800-125-0x0000000004D70000-0x0000000004D82000-memory.dmp
memory/3800-126-0x00000000058F0000-0x00000000059FA000-memory.dmp
memory/3800-127-0x0000000005A10000-0x0000000005A4E000-memory.dmp
memory/3800-128-0x0000000004DD4000-0x0000000004DD6000-memory.dmp
memory/3800-129-0x0000000005A60000-0x0000000005AAB000-memory.dmp