Analysis
- max time kernel
149s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 00:21
General
- Target a9898d9c1520abc9310c3679d142dd7f.exe
- Size 693KB
- Sample220128-ancmkadee4
- SHA256 d9213d0adeb046eda1ab1551235f3d5f4566acebe327b7e817effccf5f6d9070
Malware Config
Extracted
-
redline
-
BASICS
-
62.197.136.3:7766
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9898d9c1520abc9310c3679d142dd7f.exe"C:\Users\Admin\AppData\Local\Temp\a9898d9c1520abc9310c3679d142dd7f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a9898d9c1520abc9310c3679d142dd7f.exe"C:\Users\Admin\AppData\Local\Temp\a9898d9c1520abc9310c3679d142dd7f.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3080-123-0x0000000007EB0000-0x0000000007F40000-memory.dmp
memory/3080-116-0x0000000005960000-0x0000000005E5E000-memory.dmp
memory/3080-118-0x0000000005460000-0x000000000595E000-memory.dmp
memory/3080-119-0x0000000005680000-0x000000000568A000-memory.dmp
memory/3080-120-0x0000000007A60000-0x0000000007AFC000-memory.dmp
memory/3080-121-0x000000007F5F0000-0x000000007F5F1000-memory.dmp
memory/3080-117-0x0000000005510000-0x00000000055A2000-memory.dmp
memory/3080-122-0x0000000005940000-0x000000000594E000-memory.dmp
memory/3080-115-0x0000000000AD0000-0x0000000000B84000-memory.dmp
memory/4084-124-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4084-126-0x0000000005510000-0x0000000005B16000-memory.dmp
memory/4084-127-0x0000000004DD0000-0x0000000004DE2000-memory.dmp
memory/4084-128-0x0000000004E30000-0x0000000004E6E000-memory.dmp
memory/4084-129-0x0000000004E70000-0x0000000004EBB000-memory.dmp
memory/4084-130-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/4084-131-0x00000000050E0000-0x00000000051EA000-memory.dmp