Analysis
- max time kernel
293s - max time network
301s - platform
windows10-1703_x64 - resource
win10-20231020-en - resource tags
- submitted
13/11/2023, 09:39
General
- Target 12kI719.exe
- Size 322KB
- Sample231113-lml1dscc97
- SHA256 ddbb6f467a5ff0e61d6846af254bc836546640e3c18a82e09e2c947bbb924009
Malware Config
Extracted
-
redline
-
taiga
-
5.42.92.51:19057
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12kI719.exe"C:\Users\Admin\AppData\Local\Temp\12kI719.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4040-0-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4040-4-0x0000000073F00000-0x00000000745EE000-memory.dmp
memory/4040-6-0x000000000B530000-0x000000000B5C2000-memory.dmp
memory/4040-5-0x000000000B990000-0x000000000BE8E000-memory.dmp
memory/4040-7-0x000000000B770000-0x000000000B780000-memory.dmp
memory/4040-8-0x000000000B4E0000-0x000000000B4EA000-memory.dmp
memory/4040-9-0x000000000C4A0000-0x000000000CAA6000-memory.dmp
memory/4040-10-0x000000000BE90000-0x000000000BF9A000-memory.dmp
memory/4040-11-0x000000000B880000-0x000000000B892000-memory.dmp
memory/4040-12-0x000000000B8E0000-0x000000000B91E000-memory.dmp
memory/4040-13-0x000000000B920000-0x000000000B96B000-memory.dmp
memory/4040-18-0x0000000073F00000-0x00000000745EE000-memory.dmp
memory/4040-25-0x000000000B770000-0x000000000B780000-memory.dmp