Overview

overview

10

Static

static

10

1020-169-0...ry.exe

windows7_x64

10

1020-169-0...ry.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    36s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1020-169-0x0000000004B80000-0x0000000004BB4000-memory.exe

  • Size

    208KB

  • MD5

    b0f8ee3bf5ad2ef126c3b0406085c455

  • SHA1

    b2fb1162621e180fa6e08a2a876526af74fdf76d

  • SHA256

    d79192949fb69d0e9a2d65f78abbffbc3f9ddbddcaea01f249b19f47c835f0ae

  • SHA512

    a3eedf21de78e50f2ec62dc2feab98791746f257a42462422be66a0f94e85f45c581651cb16efedbcb8d9f8e2e0b46962afcf9c36fe13e058ed6606497a8053b

Score
10/10
redline3infostealer

Malware Config

Extracted

Family

redline

Botnet

3

C2

51.89.204.186:36124

Attributes
  • auth_value

    21358de8b6cf817d47956ee1614a9bfc

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1020-169-0x0000000004B80000-0x0000000004BB4000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1020-169-0x0000000004B80000-0x0000000004BB4000-memory.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1000-54-0x0000000000FF0000-0x0000000001024000-memory.dmp
    Filesize

    208KB

    Download