Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 13:05
Static task
static1
Behavioral task
behavioral1
Sample
ab7132b4ae565db598557ae3fa2ff8eed73353a2b3c6cedb788a94c59fef74ce.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
ab7132b4ae565db598557ae3fa2ff8eed73353a2b3c6cedb788a94c59fef74ce.exe
-
Size
458KB
-
MD5
ca26eecf9cb9f7b7d19d19a897d12e27
-
SHA1
541b92d14599f12d5a2027bd87d898bcd8574047
-
SHA256
ab7132b4ae565db598557ae3fa2ff8eed73353a2b3c6cedb788a94c59fef74ce
-
SHA512
b5d5e23cbad291c39eebb1e55062d63381ee1a0e782f294823e0da1d2127fb0073e837c3d2359559d1488b2a5b5d5e1e332f425c06cc0256c1e75dab5c4e3ee5
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
noname
C2
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4080-119-0x00000000022D0000-0x0000000002304000-memory.dmp family_redline behavioral1/memory/4080-123-0x0000000004B40000-0x0000000004B72000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ab7132b4ae565db598557ae3fa2ff8eed73353a2b3c6cedb788a94c59fef74ce.exedescription pid process Token: SeDebugPrivilege 4080 ab7132b4ae565db598557ae3fa2ff8eed73353a2b3c6cedb788a94c59fef74ce.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4080-115-0x0000000002190000-0x00000000021BC000-memory.dmpFilesize
176KB
-
memory/4080-116-0x00000000021C0000-0x00000000021F9000-memory.dmpFilesize
228KB
-
memory/4080-117-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/4080-118-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4080-119-0x00000000022D0000-0x0000000002304000-memory.dmpFilesize
208KB
-
memory/4080-120-0x0000000004C62000-0x0000000004C63000-memory.dmpFilesize
4KB
-
memory/4080-121-0x0000000004C63000-0x0000000004C64000-memory.dmpFilesize
4KB
-
memory/4080-122-0x0000000004C70000-0x000000000516E000-memory.dmpFilesize
5.0MB
-
memory/4080-123-0x0000000004B40000-0x0000000004B72000-memory.dmpFilesize
200KB
-
memory/4080-124-0x0000000005170000-0x0000000005776000-memory.dmpFilesize
6.0MB
-
memory/4080-125-0x0000000004C20000-0x0000000004C32000-memory.dmpFilesize
72KB
-
memory/4080-126-0x0000000005780000-0x000000000588A000-memory.dmpFilesize
1.0MB
-
memory/4080-127-0x0000000004C64000-0x0000000004C66000-memory.dmpFilesize
8KB
-
memory/4080-128-0x00000000058C0000-0x00000000058FE000-memory.dmpFilesize
248KB
-
memory/4080-129-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB