Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb.exe
Resource
win10v2004-20240226-en
General
-
Target
c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb.exe
-
Size
283KB
-
MD5
f63bb9145a620f420643ff58fb9be731
-
SHA1
8956e280b260d95a95846f20d66b23ef610509c6
-
SHA256
c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb
-
SHA512
cb7debffbe971615de462151e2ed44530055ba2305797d24ef0cdf467af746ea815469bbf9577baf62c388fe31ac1590bf2f60ce620775205999326b6d7bcf45
-
SSDEEP
6144:37c3s+plgJAGslW9d4d5gJ4kHFjGzPiK0WORfQNhVJ:37c3ssfRgJTFSWK0W/N
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-6-0x00000000023C0000-0x0000000002400000-memory.dmp family_redline behavioral1/memory/1812-4-0x0000000002340000-0x0000000002386000-memory.dmp family_redline behavioral1/memory/1812-8-0x0000000002380000-0x00000000023C4000-memory.dmp family_redline behavioral1/memory/1812-9-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-10-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-12-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-14-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-20-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-26-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-34-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-40-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-46-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-54-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-60-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-68-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-72-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-70-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-66-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-64-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-62-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-58-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-56-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-52-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-50-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-48-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-44-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-42-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-38-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-36-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-32-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-30-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-28-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-24-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-22-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-18-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-16-0x0000000002380000-0x00000000023BE000-memory.dmp family_redline behavioral1/memory/1812-915-0x00000000023C0000-0x0000000002400000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb.exedescription pid process Token: SeDebugPrivilege 1812 c6fb150e8994f65827aae374d044a96b18581026cf0b74ce37239cf55461bffb.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1812-1-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1812-3-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/1812-2-0x0000000000300000-0x000000000034B000-memory.dmpFilesize
300KB
-
memory/1812-5-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1812-6-0x00000000023C0000-0x0000000002400000-memory.dmpFilesize
256KB
-
memory/1812-4-0x0000000002340000-0x0000000002386000-memory.dmpFilesize
280KB
-
memory/1812-7-0x00000000023C0000-0x0000000002400000-memory.dmpFilesize
256KB
-
memory/1812-8-0x0000000002380000-0x00000000023C4000-memory.dmpFilesize
272KB
-
memory/1812-9-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-10-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-12-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-14-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-20-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-26-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-34-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-40-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-46-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-54-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-60-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-68-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-72-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-70-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-66-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-64-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-62-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-58-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-56-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-52-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-50-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-48-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-44-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-42-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-38-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-36-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-32-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-30-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-28-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-24-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-22-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-18-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-16-0x0000000002380000-0x00000000023BE000-memory.dmpFilesize
248KB
-
memory/1812-915-0x00000000023C0000-0x0000000002400000-memory.dmpFilesize
256KB
-
memory/1812-916-0x0000000000560000-0x0000000000660000-memory.dmpFilesize
1024KB
-
memory/1812-918-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/1812-919-0x00000000023C0000-0x0000000002400000-memory.dmpFilesize
256KB
-
memory/1812-921-0x00000000023C0000-0x0000000002400000-memory.dmpFilesize
256KB