Analysis
- max time kernel
130s - max time network
144s - platform
windows10_x64 - resource
win10-20220414-en - submitted
09/05/2022, 08:50
General
- Target 992f3ebf8da598df9727bb18d21a3e604ee6bd3a55781eb664744fce17427ca7.exe
- Size 366KB
- Sample220509-krmbaafffr
- SHA256 992f3ebf8da598df9727bb18d21a3e604ee6bd3a55781eb664744fce17427ca7
Malware Config
Extracted
-
redline
-
old
-
honantharis.xyz:81
-
auth_value
eebc7bceda23185ce5e37704c7ee05ed
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\992f3ebf8da598df9727bb18d21a3e604ee6bd3a55781eb664744fce17427ca7.exe"C:\Users\Admin\AppData\Local\Temp\992f3ebf8da598df9727bb18d21a3e604ee6bd3a55781eb664744fce17427ca7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-117-0x00000000004A0000-0x000000000054E000-memory.dmp
memory/2092-118-0x00000000008E0000-0x0000000000917000-memory.dmp
memory/2092-119-0x0000000000400000-0x000000000049D000-memory.dmp
memory/2092-120-0x0000000002620000-0x0000000002650000-memory.dmp
memory/2092-121-0x0000000004C00000-0x00000000050FE000-memory.dmp
memory/2092-122-0x00000000026A0000-0x00000000026CE000-memory.dmp
memory/2092-123-0x0000000005100000-0x0000000005706000-memory.dmp
memory/2092-124-0x0000000005720000-0x0000000005732000-memory.dmp
memory/2092-125-0x0000000005750000-0x000000000585A000-memory.dmp
memory/2092-126-0x0000000005860000-0x000000000589E000-memory.dmp
memory/2092-127-0x00000000059F0000-0x0000000005A3B000-memory.dmp