Analysis
- max time kernel
135s - max time network
146s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 06:17
General
- Target d1b777e6efc74d3acdf5bc17da7b5107.exe
- Size 355KB
- Sample211005-g1191shfbl
- SHA256 69a9ded4f74e191eec40ecb64268926a05370d82ccd635f73b5e787402b9663d
Malware Config
Extracted
-
redline
-
build
-
185.244.182.136:51832
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b777e6efc74d3acdf5bc17da7b5107.exe"C:\Users\Admin\AppData\Local\Temp\d1b777e6efc74d3acdf5bc17da7b5107.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/776-114-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/776-115-0x0000000000400000-0x0000000000466000-memory.dmp
memory/776-116-0x00000000007F0000-0x000000000080F000-memory.dmp
memory/776-117-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/776-118-0x0000000002680000-0x000000000269D000-memory.dmp
memory/776-119-0x0000000005210000-0x0000000005211000-memory.dmp
memory/776-120-0x0000000005820000-0x0000000005821000-memory.dmp
memory/776-122-0x0000000004D02000-0x0000000004D03000-memory.dmp
memory/776-121-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/776-123-0x0000000004D03000-0x0000000004D04000-memory.dmp
memory/776-124-0x00000000058C0000-0x00000000058C1000-memory.dmp
memory/776-125-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/776-126-0x0000000007190000-0x0000000007191000-memory.dmp
memory/776-127-0x0000000004D04000-0x0000000004D06000-memory.dmp
memory/776-128-0x0000000007310000-0x0000000007311000-memory.dmp