Analysis
-
max time kernel
4294221s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
26-03-2022 13:32
Static task
static1
Behavioral task
behavioral1
Sample
1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2.exe
Resource
win10v2004-en-20220113
General
-
Target
1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2.exe
-
Size
415KB
-
MD5
7e9ad434906fa0f11a015069405f3131
-
SHA1
7c72d6f8eac181d86a6f140dee6a3fa3a8743c44
-
SHA256
1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2
-
SHA512
6446110bce355df5b38023ad9ef4f0a81ddbadc9fca40fac4598e75af51eb938d58b68988c35919d76b170413587ec82a43af0021477c052458839b366e00838
Malware Config
Extracted
redline
NEW_YEAR_BTC
86.105.252.12:35200
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1828-56-0x00000000060B0000-0x00000000060DA000-memory.dmp family_redline behavioral1/memory/1828-57-0x00000000060E0000-0x0000000006108000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2.exedescription pid process Token: SeDebugPrivilege 1828 1df83daff547b9c41d0d33c6f400391dcdcdbb685dc757d88cd87900aab94fe2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-54-0x0000000000230000-0x0000000000254000-memory.dmpFilesize
144KB
-
memory/1828-55-0x0000000000260000-0x0000000000292000-memory.dmpFilesize
200KB
-
memory/1828-56-0x00000000060B0000-0x00000000060DA000-memory.dmpFilesize
168KB
-
memory/1828-57-0x00000000060E0000-0x0000000006108000-memory.dmpFilesize
160KB
-
memory/1828-58-0x0000000000400000-0x00000000046E9000-memory.dmpFilesize
66.9MB
-
memory/1828-59-0x0000000008ED4000-0x0000000008ED6000-memory.dmpFilesize
8KB