Analysis
- max time kernel
4294200s - max time network
151s - platform
windows7_x64 - resource
win7-20220310-en - submitted
19/03/2022, 05:06
General
- Target 22817028.exe
- Size 379KB
- Sample220319-frffhscbe2
- SHA256 827dcd6eeff67fb8fd1322c9eeccc9558713bf83b4353669b3d7cc826cadf2f1
Malware Config
Extracted
-
redline
-
185.215.113.87:33960
-
auth_value
5b8db73fbe6dd9a89df2f5cca90c0f20
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22817028.exe"C:\Users\Admin\AppData\Local\Temp\22817028.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1500-54-0x0000000000220000-0x000000000024B000-memory.dmp
memory/1500-55-0x0000000000250000-0x0000000000289000-memory.dmp
memory/1500-56-0x0000000000400000-0x000000000192E000-memory.dmp
memory/1500-57-0x0000000005D91000-0x0000000005D92000-memory.dmp
memory/1500-58-0x0000000003370000-0x00000000033A4000-memory.dmp
memory/1500-59-0x0000000074A70000-0x000000007515E000-memory.dmp
memory/1500-60-0x0000000005D92000-0x0000000005D93000-memory.dmp
memory/1500-61-0x0000000005D93000-0x0000000005D94000-memory.dmp
memory/1500-62-0x00000000033A0000-0x00000000033D2000-memory.dmp
memory/1500-63-0x0000000005D94000-0x0000000005D96000-memory.dmp