Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-04-2023 13:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230221-en
General
-
Target
tmp.exe
-
Size
343KB
-
MD5
b4366bb38342bf5092ecc110684d091e
-
SHA1
4abe6534a59472bb469b5d65d6988a9ac3baaffa
-
SHA256
5098edc4249c3b818f3d99da1491aa8e51060f8714641bdf7ee7524a4df5ce4b
-
SHA512
227dc47c63822ef6744174dd43ce2dae80177ac19a03b3a7dcd49350a3845a19f9fb5bec8c063e3243ad9a755f00d77306b1e200e97daf83030062c76b164085
-
SSDEEP
6144:tZO6UaE2WsWx6+t5WY/G2uQRxbqf+NU9GsCPaW:tg6rE2W3lLv/aAGfrGZf
Malware Config
Extracted
redline
@chicago
185.11.61.125:22344
-
auth_value
21f863e0cbd09d0681058e068d0d1d7f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/1560-55-0x00000000021B0000-0x000000000220A000-memory.dmp family_redline behavioral1/memory/1560-59-0x0000000002230000-0x0000000002288000-memory.dmp family_redline behavioral1/memory/1560-60-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-61-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-63-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-65-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-67-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-71-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-73-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-75-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-77-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-79-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-81-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-85-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-87-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-93-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-95-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-97-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-99-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-101-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-105-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-103-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-107-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-109-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-111-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-113-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-115-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-117-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-119-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-121-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-123-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-91-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-89-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-83-0x0000000002230000-0x0000000002282000-memory.dmp family_redline behavioral1/memory/1560-69-0x0000000002230000-0x0000000002282000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 1560 tmp.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1560-55-0x00000000021B0000-0x000000000220A000-memory.dmpFilesize
360KB
-
memory/1560-56-0x00000000002D0000-0x0000000000332000-memory.dmpFilesize
392KB
-
memory/1560-58-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/1560-57-0x0000000004D40000-0x0000000004D80000-memory.dmpFilesize
256KB
-
memory/1560-59-0x0000000002230000-0x0000000002288000-memory.dmpFilesize
352KB
-
memory/1560-60-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-61-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-63-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-65-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-67-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-71-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-73-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-75-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-77-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-79-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-81-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-85-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-87-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-93-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-95-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-97-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-99-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-101-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-105-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-103-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-107-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-109-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-111-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-113-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-115-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-117-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-119-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-121-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-123-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-91-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-89-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-83-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB
-
memory/1560-69-0x0000000002230000-0x0000000002282000-memory.dmpFilesize
328KB