redline | e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1

Analysis

max time kernel
142s
max time network
160s
platform
windows10_x64
resource
win10-en-20211208
submitted
12-02-2022 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe
Size

385KB
MD5

c708ad0d3115e59d5d01f415b1f4d4a9
SHA1

f33c2245b17d6367533706a3858593006be12e08
SHA256

e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1
SHA512

30f028e8f9f820a282574bc78378a8d477f6bd21597c4cb20b89f36c2db91cd809b37f1a812cd5f75fafe52e7744e027fe4b8d7a08da36e2dc7d9842d82883cd

Score

10^/10

redline ruzkikakoyto infostealer

Malware Config

Extracted

Family

redline

Botnet

ruzkiKAKOYTO

185.215.113.29:20819

Attributes

auth_value
44e87155dd7a4d1957a956ed040ff3fd

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3352-119-0x00000000036D0000-0x0000000003704000-memory.dmp	family_redline
behavioral1/memory/3352-124-0x0000000005FE0000-0x0000000006012000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe

description pid process

Token: SeDebugPrivilege 3352 e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe

description	pid	process
Token: SeDebugPrivilege	3352	e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe

C:\Users\Admin\AppData\Local\Temp\e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe
"C:\Users\Admin\AppData\Local\Temp\e8b9844daf7785dde22c233a7fae1abdc2ec14db4380735b3890c28cb57d26c1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3352-115-0x00000000019D0000-0x00000000019FC000-memory.dmp

Filesize
176KB

Download
memory/3352-116-0x0000000001A00000-0x0000000001A39000-memory.dmp

Filesize
228KB

Download
memory/3352-117-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3352-118-0x0000000073EAE000-0x0000000073EAF000-memory.dmp

Filesize
4KB

Download
memory/3352-119-0x00000000036D0000-0x0000000003704000-memory.dmp

Filesize
208KB

Download
memory/3352-120-0x0000000006130000-0x0000000006131000-memory.dmp

Filesize
4KB

Download
memory/3352-121-0x0000000006132000-0x0000000006133000-memory.dmp

Filesize
4KB

Download
memory/3352-122-0x0000000006133000-0x0000000006134000-memory.dmp

Filesize
4KB

Download
memory/3352-123-0x0000000006140000-0x000000000663E000-memory.dmp

Filesize
5.0MB

Download
memory/3352-124-0x0000000005FE0000-0x0000000006012000-memory.dmp

Filesize
200KB

Download
memory/3352-125-0x0000000006640000-0x0000000006C46000-memory.dmp

Filesize
6.0MB

Download
memory/3352-126-0x00000000060D0000-0x00000000060E2000-memory.dmp

Filesize
72KB

Download
memory/3352-127-0x0000000006C50000-0x0000000006D5A000-memory.dmp

Filesize
1.0MB

Download
memory/3352-128-0x0000000006134000-0x0000000006136000-memory.dmp

Filesize
8KB

Download
memory/3352-129-0x0000000006D70000-0x0000000006DAE000-memory.dmp

Filesize
248KB

Download
memory/3352-130-0x0000000007040000-0x000000000708B000-memory.dmp

Filesize
300KB

Download
memory/3352-131-0x0000000001C20000-0x0000000001C86000-memory.dmp

Filesize
408KB

Download
memory/3352-132-0x00000000075E0000-0x0000000007656000-memory.dmp

Filesize
472KB

Download
memory/3352-133-0x0000000007680000-0x0000000007712000-memory.dmp

Filesize
584KB

Download
memory/3352-134-0x0000000007770000-0x000000000778E000-memory.dmp

Filesize
120KB

Download