Analysis
- max time kernel
4294198s - max time network
150s - platform
windows7_x64 - resource
win7-20220223-en - submitted
08/03/2022, 18:01
General
- Target dc6e898225c4ec7b40fd5736d2e97437.exe
- Size 467KB
- Sample220308-wlwtbaaaf6
- SHA256 370cb8aefcc51ea907633016aa4963063270b3a3ee8ab5c346ced7c10b97a18f
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
mulik
C2
-
tanavelt.xyz:80
Attributes
-
auth_value
8305635220226e7b293c4b2da3ba1b2e
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe"C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exeC:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1652-58-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1652-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1652-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1652-63-0x0000000073DB0000-0x000000007449E000-memory.dmp
memory/1652-64-0x0000000002280000-0x0000000002281000-memory.dmp
memory/1828-54-0x0000000000260000-0x00000000002DA000-memory.dmp
memory/1828-55-0x00000000744A0000-0x0000000074B8E000-memory.dmp
memory/1828-56-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/1828-57-0x0000000000380000-0x0000000000381000-memory.dmp