Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
28-03-2023 07:45
General
-
Target
1692-56-0x0000000004B00000-0x0000000004B58000-memory.exe
-
Size
352KB
-
MD5
6f64079e8ccc70d23f16af9d111a2414
-
SHA1
e3338d72806759341a72e95c2a900a33d5b208ef
-
SHA256
d96eb32f1c38f5dae7c3147af33f249f3ccad200298e42ab758ce3329120e5c0
-
SHA512
a4b51cb40ed279761fee4e95da44a24119e14e085b28aed03b536121a0f15402ae2fd0ddb7449b5eb9bb217726e9fb7132add1da1056d3ce004e9f6da2f2ae51
-
SSDEEP
3072:H4JS+yL3KN09yt41ScYumzdnnrsp04O4/eZJNfiALSrBdn5xkArN:kyLaN09y7cYumzt0yU3kA
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ROBER
C2
138.201.195.134:15564
Attributes
-
auth_value
de311ede2b43457816afc0d9989c5255
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1692-56-0x0000000004B00000-0x0000000004B58000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1692-56-0x0000000004B00000-0x0000000004B58000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB