Analysis
-
max time kernel
47s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29-10-2022 21:05
General
-
Target
1472-532-0x0000000004D90000-0x0000000004DCC000-memory.exe
-
Size
240KB
-
MD5
13eac3a5b2f6b84af814e7406eb9521c
-
SHA1
f838271987ff574b128b0a44dc09d0f296ccff86
-
SHA256
26183ea541e0ee50801d7f49b1d86c7c651222ee703851cf8cefbb19e3e0e426
-
SHA512
493699380c0c1b3088e5c496467aeb5597eed144dc66a1306b9147b8e679b4b4f66b10af7d6cd510ad490b3455ab17f3227ed1a8a034cddafa1f1f9cbab1ad0c
-
SSDEEP
3072:jjqrLUeDQRiORL49P84HHmQNcor5KjGmhoe/uxxgChG5OA9paZwJGEKH:jjq3+iR3HH1NpdWlEeChg9paZF
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
slovarik1btc
C2
78.153.144.3:2510
Attributes
-
auth_value
69236173f96390de00bb5a5120a1f3a0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1472-532-0x0000000004D90000-0x0000000004DCC000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1472-532-0x0000000004D90000-0x0000000004DCC000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB