Analysis
-
max time kernel
28s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
15/02/2023, 17:09
General
-
Target
992-87-0x0000000000C30000-0x0000000000C74000-memory.exe
-
Size
272KB
-
MD5
88557002fb92104f4705fb31161d0c14
-
SHA1
4a8cd1560205263ac9bd4c4160aa79fd6540ace2
-
SHA256
cbf25450e53183aac47b38835f9eb7d2d6bf6153a7373ae2100ab3f74fdf113d
-
SHA512
ce14870efb235028952b6719f68da5e2f55f196b5e15241edc2b387396f284b61792e3397c5f969db927fb82d34a97dc55600677416e382e3a927b7d9d801964
-
SSDEEP
3072:B6jIELf6FDTCLkYxJw6qxYgcgpiiSo40jm8dAhTrnz5XD1NxNn2pU9f2MKTV/wi1:B6jodYx9cYKpzwAAh3nz
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ruma
C2
193.233.20.13:4136
Attributes
-
auth_value
647d00dfaba082a4a30f383bca5d1a2a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\992-87-0x0000000000C30000-0x0000000000C74000-memory.exe"C:\Users\Admin\AppData\Local\Temp\992-87-0x0000000000C30000-0x0000000000C74000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB