Overview

overview

10

Static

static

DATA PROTE...32.dll

windows7_x64

1

DATA PROTE...32.dll

windows10-2004_x64

1

DATA PROTE...se.dll

windows7_x64

1

DATA PROTE...se.dll

windows10-2004_x64

1

DATA PROTE...l3.dll

windows7_x64

1

DATA PROTE...l3.dll

windows10-2004_x64

1

Video.mp4.scr

windows7_x64

1

Video.mp4.scr

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-07-2022 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Video.mp4.scr

  • Size

    700.0MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Score
10/10
redline1infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
        PID:684

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Video.mp4.scr.log
      Filesize

      1KB

      MD5

      df27a876383bd81dfbcb457a9fa9f09d

      SHA1

      1bbc4ab95c89d02ec1d217f0255205787999164e

      SHA256

      8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

      SHA512

      fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

      Download Submit
    • memory/684-134-0x0000000000000000-mapping.dmp
      Download
    • memory/684-135-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download
    • memory/684-137-0x0000000005FA0000-0x00000000065B8000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/684-138-0x0000000005A20000-0x0000000005A32000-memory.dmp
      Filesize

      72KB

      Download
    • memory/684-139-0x0000000005B50000-0x0000000005C5A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/684-140-0x0000000005A80000-0x0000000005ABC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/4384-130-0x0000000000AB0000-0x0000000000C36000-memory.dmp
      Filesize

      1.5MB

      Download
    • memory/4384-131-0x0000000005B70000-0x0000000006114000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4384-132-0x0000000005660000-0x00000000056F2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4384-133-0x0000000005620000-0x000000000562A000-memory.dmp
      Filesize

      40KB

      Download