Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 05:51
Static task
static1
Behavioral task
behavioral1
Sample
2e2bd7e768ae261118cd7f188808c0c2b2df6611106bf7cf53d4838e4714d788.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
2e2bd7e768ae261118cd7f188808c0c2b2df6611106bf7cf53d4838e4714d788.exe
-
Size
318KB
-
MD5
96f8d58ff3de48d27d85159b16026a8e
-
SHA1
24f90847ef555729dd36ed90d8ba9bf83ee3ea6a
-
SHA256
2e2bd7e768ae261118cd7f188808c0c2b2df6611106bf7cf53d4838e4714d788
-
SHA512
e1fe68acc70d05466b39ba3da878ef51aa49e3b729b116b9b48db360c64e5cb2962621cc1f456a54b97d6586f1651529b556e286b418ec492529912b2eae7c38
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
usamoney
C2
45.142.215.47:27643
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2016-116-0x00000000021E0000-0x00000000021FF000-memory.dmp family_redline behavioral1/memory/2016-123-0x00000000023D0000-0x00000000023ED000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-115-0x0000000000571000-0x0000000000594000-memory.dmpFilesize
140KB
-
memory/2016-116-0x00000000021E0000-0x00000000021FF000-memory.dmpFilesize
124KB
-
memory/2016-118-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/2016-119-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/2016-120-0x0000000004D22000-0x0000000004D23000-memory.dmpFilesize
4KB
-
memory/2016-122-0x0000000004D23000-0x0000000004D24000-memory.dmpFilesize
4KB
-
memory/2016-121-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/2016-117-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/2016-123-0x00000000023D0000-0x00000000023ED000-memory.dmpFilesize
116KB
-
memory/2016-124-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/2016-125-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/2016-126-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/2016-127-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/2016-128-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/2016-129-0x0000000004D24000-0x0000000004D26000-memory.dmpFilesize
8KB