Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    09-05-2022 12:20

General

  • Target

    7b08f0f328eb6e8e7b9a8740ad462e5768e5ec02a7867ab289749d13ade33fb9.exe

  • Size

    367KB

  • MD5

    343ff0c8d60adb517969755c5cbd1c33

  • SHA1

    253e3f20fcb18ea9b2e5247208a2425f5a783d87

  • SHA256

    7b08f0f328eb6e8e7b9a8740ad462e5768e5ec02a7867ab289749d13ade33fb9

  • SHA512

    67dc50737daa6d45acaeff8ae62246be41b519625e2c8437726e6e802832f028dbd8c2bc2f470483fbfcb3bdcf6bb6a0f09985eda98c27e3a6032bbbc8ef4978

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

old

C2

honantharis.xyz:81

Attributes
  • auth_value

    eebc7bceda23185ce5e37704c7ee05ed

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b08f0f328eb6e8e7b9a8740ad462e5768e5ec02a7867ab289749d13ade33fb9.exe
    "C:\Users\Admin\AppData\Local\Temp\7b08f0f328eb6e8e7b9a8740ad462e5768e5ec02a7867ab289749d13ade33fb9.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3768-117-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-118-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-119-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-120-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-121-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-122-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-123-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-124-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-125-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-126-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-128-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-127-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-129-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-130-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-131-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-132-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-133-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-134-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-135-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-136-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-137-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-138-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-139-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-140-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-141-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-142-0x0000000000673000-0x000000000069D000-memory.dmp

    Filesize

    168KB

  • memory/3768-144-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-143-0x00000000004F0000-0x000000000063A000-memory.dmp

    Filesize

    1.3MB

  • memory/3768-145-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-146-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-147-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-148-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-149-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-150-0x0000000000400000-0x000000000049E000-memory.dmp

    Filesize

    632KB

  • memory/3768-151-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-153-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-152-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-154-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-155-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-156-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-157-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-158-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-159-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-160-0x00000000023C0000-0x00000000023F0000-memory.dmp

    Filesize

    192KB

  • memory/3768-161-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-162-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-163-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-164-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-165-0x0000000004CF0000-0x00000000051EE000-memory.dmp

    Filesize

    5.0MB

  • memory/3768-166-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-167-0x0000000002470000-0x000000000249E000-memory.dmp

    Filesize

    184KB

  • memory/3768-168-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-169-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-170-0x0000000005800000-0x0000000005E06000-memory.dmp

    Filesize

    6.0MB

  • memory/3768-171-0x0000000002560000-0x0000000002572000-memory.dmp

    Filesize

    72KB

  • memory/3768-172-0x0000000004B70000-0x0000000004C7A000-memory.dmp

    Filesize

    1.0MB

  • memory/3768-173-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-174-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-175-0x00000000025D0000-0x000000000260E000-memory.dmp

    Filesize

    248KB

  • memory/3768-176-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-177-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-178-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-179-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-180-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-181-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-182-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-183-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-184-0x0000000004C90000-0x0000000004CDB000-memory.dmp

    Filesize

    300KB

  • memory/3768-185-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-186-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-187-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-188-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-189-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-190-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB

  • memory/3768-191-0x0000000076F60000-0x00000000770EE000-memory.dmp

    Filesize

    1.6MB