Analysis
- max time kernel
191s - max time network
210s - platform
windows7_x64 - resource
win7-20220414-en - submitted
12/05/2022, 15:22
General
- Target 14b1f20f3ec1d9fa4a7f6eb9c2ae96e3.exe
- Size 426KB
- Sample220512-srwhyscggn
- SHA256 8a9368e459952f9652f83bdbb2e834bc7227d2f22e7d07980ab489c1df3ea0a1
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
test2
C2
-
matarabanea.xyz:80
-
olaneraskan.xyz:80
Attributes
-
auth_value
6e517e8b30d5a27159455acbfa346caf
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14b1f20f3ec1d9fa4a7f6eb9c2ae96e3.exe"C:\Users\Admin\AppData\Local\Temp\14b1f20f3ec1d9fa4a7f6eb9c2ae96e3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1380-55-0x0000000000230000-0x0000000000330000-memory.dmp
memory/1380-56-0x00000000003A0000-0x00000000003D9000-memory.dmp
memory/1380-57-0x0000000000400000-0x00000000004AB000-memory.dmp
memory/1380-58-0x0000000001FD0000-0x0000000002004000-memory.dmp
memory/1380-59-0x0000000004780000-0x00000000047B4000-memory.dmp
memory/1380-60-0x0000000075AE1000-0x0000000075AE3000-memory.dmp