Analysis
- max time kernel
132s - max time network
146s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
18/02/2023, 08:53
General
- Target 32c8b3b5e43f7f5899f1f3c275cbdce1.exe
- Size 316KB
- Sample230218-ktbbssbf67
- SHA256 1354fea783bfe2d72267bb11cd26ddd9850b93ad93592d9b8e48eb072cfdfc68
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
ruma
C2
-
193.233.20.13:4136
Attributes
-
auth_value
647d00dfaba082a4a30f383bca5d1a2a
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32c8b3b5e43f7f5899f1f3c275cbdce1.exe"C:\Users\Admin\AppData\Local\Temp\32c8b3b5e43f7f5899f1f3c275cbdce1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/604-54-0x0000000075F81000-0x0000000075F83000-memory.dmp
memory/604-55-0x00000000006EE000-0x000000000071D000-memory.dmp
memory/604-56-0x0000000000220000-0x000000000026B000-memory.dmp
memory/604-57-0x0000000000400000-0x0000000000584000-memory.dmp
memory/604-58-0x00000000020C0000-0x0000000002106000-memory.dmp
memory/604-59-0x00000000021A0000-0x00000000021E4000-memory.dmp
memory/604-60-0x00000000006EE000-0x000000000071D000-memory.dmp