Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2023 15:38
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp.exe
-
Size
343KB
-
MD5
b4366bb38342bf5092ecc110684d091e
-
SHA1
4abe6534a59472bb469b5d65d6988a9ac3baaffa
-
SHA256
5098edc4249c3b818f3d99da1491aa8e51060f8714641bdf7ee7524a4df5ce4b
-
SHA512
227dc47c63822ef6744174dd43ce2dae80177ac19a03b3a7dcd49350a3845a19f9fb5bec8c063e3243ad9a755f00d77306b1e200e97daf83030062c76b164085
-
SSDEEP
6144:tZO6UaE2WsWx6+t5WY/G2uQRxbqf+NU9GsCPaW:tg6rE2W3lLv/aAGfrGZf
Malware Config
Extracted
redline
@chicago
185.11.61.125:22344
-
auth_value
21f863e0cbd09d0681058e068d0d1d7f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral2/memory/3804-139-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-140-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-142-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-144-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-146-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-148-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-150-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-152-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-154-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-156-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-158-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-160-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-162-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-164-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-166-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-168-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-170-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-174-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-172-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-176-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-178-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-180-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-182-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-184-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-186-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-188-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-190-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-192-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-194-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-196-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-198-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-200-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline behavioral2/memory/3804-202-0x0000000004F50000-0x0000000004FA2000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 3804 tmp.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3804-134-0x0000000002560000-0x00000000025C2000-memory.dmpFilesize
392KB
-
memory/3804-135-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-136-0x0000000005060000-0x0000000005604000-memory.dmpFilesize
5.6MB
-
memory/3804-137-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-138-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-139-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-140-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-142-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-144-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-146-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-148-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-150-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-152-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-154-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-156-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-158-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-160-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-162-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-164-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-166-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-168-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-170-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-174-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-172-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-176-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-178-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-180-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-182-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-184-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-186-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-188-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-190-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-192-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-194-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-196-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-198-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-200-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-202-0x0000000004F50000-0x0000000004FA2000-memory.dmpFilesize
328KB
-
memory/3804-929-0x0000000005610000-0x0000000005C28000-memory.dmpFilesize
6.1MB
-
memory/3804-930-0x0000000005C30000-0x0000000005C42000-memory.dmpFilesize
72KB
-
memory/3804-931-0x0000000005C50000-0x0000000005D5A000-memory.dmpFilesize
1.0MB
-
memory/3804-932-0x0000000005D60000-0x0000000005D9C000-memory.dmpFilesize
240KB
-
memory/3804-933-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-935-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-936-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3804-937-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB