redline | d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2 | Triage

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 18:36

Sharing

Report Analysis Logs

General

Target

Build.exe
Size

141KB
MD5

19e47b9abf123f4502545a5fcb43c855
SHA1

c722baba8294f20abdb344b61d72d444a4171b62
SHA256

d3215483bba6219bb6587367aa3fa8c1737706497ed4befcb175649dc00e7be2
SHA512

8c358748e913fdf227b58f6a46719fa7582295e30dcfe9b06fce624240d066f666d481d661ee42b106ff32e78877993d9680e921a9bc1fca4aa00269d2b09173
SSDEEP

3072:FK1JZOpTvVQZ+rcIeRYs6YmszJqoD2X7BpGGoMTb3R35dINX9r59x4:kOpu0rjeRbVJqoDC1pGGoMTb3RDINN

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2280-1-0x0000000000810000-0x000000000083A000-memory.dmp family_redline
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Build.exe

description pid process

Token: SeDebugPrivilege 2280 Build.exe

C:\Users\Admin\AppData\Local\Temp\Build.exe
"C:\Users\Admin\AppData\Local\Temp\Build.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/2280-1-0x0000000000810000-0x000000000083A000-memory.dmp

Filesize
168KB

Download
memory/2280-2-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download