Overview

overview

10

Static

static

10

042056ffd5...b1.exe

windows7_x64

10

042056ffd5...b1.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    05-03-2022 16:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    042056ffd522fe97e44829ba8bae5f9b182042267069d80d6ca6884e89695cb1.exe

  • Size

    126KB

  • MD5

    b0b26931d589ced06db1f468b731c547

  • SHA1

    a0653f11e7a4d861397184675b0ed2dd5dfc9cc3

  • SHA256

    042056ffd522fe97e44829ba8bae5f9b182042267069d80d6ca6884e89695cb1

  • SHA512

    228c03d30e5db67b83824a0b0d12785415bb8e120a9225437b5f0a61cacf42f296dd0434c5b025d1d74e460a22a2f7c7d1a67d6cc8cc257bbc4c249ae59470c0

Score
10/10
redline10infostealer

Malware Config

Extracted

Family

redline

Botnet

10

C2

80.66.87.14:35200

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\042056ffd522fe97e44829ba8bae5f9b182042267069d80d6ca6884e89695cb1.exe
    "C:\Users\Admin\AppData\Local\Temp\042056ffd522fe97e44829ba8bae5f9b182042267069d80d6ca6884e89695cb1.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3980-130-0x00000000000D0000-0x00000000000F6000-memory.dmp
    Filesize

    152KB

    Download
  • memory/3980-131-0x0000000004FD0000-0x00000000055E8000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/3980-132-0x0000000004A60000-0x0000000004A72000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3980-133-0x0000000004AC0000-0x0000000004AFC000-memory.dmp
    Filesize

    240KB

    Download
  • memory/3980-134-0x0000000074440000-0x0000000074BF0000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/3980-135-0x0000000004D70000-0x0000000004E7A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3980-136-0x00000000049B0000-0x0000000004FC8000-memory.dmp
    Filesize

    6.1MB

    Download