Analysis
- max time kernel
141s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
08/03/2022, 18:01
General
- Target dc6e898225c4ec7b40fd5736d2e97437.exe
- Size 467KB
- Sample220308-wlwtbaaaf6
- SHA256 370cb8aefcc51ea907633016aa4963063270b3a3ee8ab5c346ced7c10b97a18f
Malware Config
Extracted
-
redline
-
mulik
-
tanavelt.xyz:80
-
auth_value
8305635220226e7b293c4b2da3ba1b2e
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe"C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exeC:\Users\Admin\AppData\Local\Temp\dc6e898225c4ec7b40fd5736d2e97437.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3236-134-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3236-135-0x0000000074B30000-0x00000000752E0000-memory.dmp
memory/3236-136-0x00000000058D0000-0x0000000005EE8000-memory.dmp
memory/3236-137-0x0000000005350000-0x0000000005362000-memory.dmp
memory/3236-138-0x0000000005480000-0x000000000558A000-memory.dmp
memory/3236-139-0x00000000052B0000-0x00000000058C8000-memory.dmp
memory/3236-140-0x00000000053B0000-0x00000000053EC000-memory.dmp
memory/3672-130-0x0000000074B30000-0x00000000752E0000-memory.dmp
memory/3672-131-0x00000000002F0000-0x000000000036A000-memory.dmp
memory/3672-132-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/3672-133-0x0000000004C20000-0x0000000004C21000-memory.dmp