Analysis
- max time kernel
134s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
03/10/2021, 12:30
General
- Target a36c888f47eceb950d47caa689236157.exe
- Size 390KB
- Sample211003-ppgp8sfdc8
- SHA256 0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde
Malware Config
Extracted
-
redline
-
UTS
-
45.9.20.20:13441
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a36c888f47eceb950d47caa689236157.exe"C:\Users\Admin\AppData\Local\Temp\a36c888f47eceb950d47caa689236157.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2160-115-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/2160-116-0x0000000000400000-0x000000000046E000-memory.dmp
memory/2160-117-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/2160-118-0x0000000002170000-0x000000000218F000-memory.dmp
memory/2160-119-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/2160-120-0x0000000002570000-0x000000000258E000-memory.dmp
memory/2160-121-0x0000000005290000-0x0000000005291000-memory.dmp
memory/2160-122-0x0000000002620000-0x0000000002621000-memory.dmp
memory/2160-123-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/2160-124-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/2160-125-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/2160-127-0x0000000004D83000-0x0000000004D84000-memory.dmp
memory/2160-128-0x0000000004D84000-0x0000000004D86000-memory.dmp
memory/2160-126-0x0000000004D82000-0x0000000004D83000-memory.dmp