Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
22-08-2022 13:48
General
-
Target
1870b9995da0d798507e5661f6dfc6ce375b97e487a2d4c0b89741a2a986ab2c.exe
-
Size
352KB
-
MD5
312096992dabaa78f39001149136f69f
-
SHA1
f95fccb283b6da9e0dc22f39e9a72b540e1f1445
-
SHA256
1870b9995da0d798507e5661f6dfc6ce375b97e487a2d4c0b89741a2a986ab2c
-
SHA512
6b531587ff25f8de76d48ee11da348dddb65411d9fd3b2958760202e812e4f9a8eed767cf55284fd50f123985e5d4a86b179258211fe74b02a8b338682185b9c
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ruzki
C2
193.106.191.165:39482
Attributes
-
auth_value
71a0558c0eea274a5bd617ea85786884
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1870b9995da0d798507e5661f6dfc6ce375b97e487a2d4c0b89741a2a986ab2c.exe"C:\Users\Admin\AppData\Local\Temp\1870b9995da0d798507e5661f6dfc6ce375b97e487a2d4c0b89741a2a986ab2c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-55-0x0000000000220000-0x0000000000258000-memory.dmpFilesize
224KB
-
memory/1976-54-0x000000000266C000-0x0000000002696000-memory.dmpFilesize
168KB
-
memory/1976-56-0x0000000000400000-0x00000000024DD000-memory.dmpFilesize
32.9MB
-
memory/1976-57-0x00000000025C0000-0x00000000025F2000-memory.dmpFilesize
200KB
-
memory/1976-58-0x0000000002620000-0x0000000002650000-memory.dmpFilesize
192KB
-
memory/1976-59-0x000000000266C000-0x0000000002696000-memory.dmpFilesize
168KB
-
memory/1976-60-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB