Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-09-2022 00:43
General
-
Target
81296-1076-0x0000000002630000-0x000000000266C000-memory.exe
-
Size
240KB
-
MD5
23a3f37ab60fb21f031bca09728e53ea
-
SHA1
e3e814137b20b5e64f50576c543bc761bf958ddc
-
SHA256
fbf72239ab51523719df85eb3231baea2d4b1f2f83bd0e239409d665812a613a
-
SHA512
7d906cf5f29dc64e50d42f15668e8e2e9b5d5d386aeb00c3c6ed4d9c81862deaccffc1aca0dec467850944e67626a83db24933d941b042bc54f6e84a48cc1574
-
SSDEEP
3072:bjq7LOeZQM9ORvEiptCqQNcYKr5IajGsoe/hMh8OhRhO8+q9E3:bjq7P99otCZN4dNfOhT
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
32489234
C2
78.153.144.6:2510
Attributes
-
auth_value
ad7ebeff731e5655a1b7feb5e468ead2
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81296-1076-0x0000000002630000-0x000000000266C000-memory.exe"C:\Users\Admin\AppData\Local\Temp\81296-1076-0x0000000002630000-0x000000000266C000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB