Analysis
- max time kernel
137s - max time network
160s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
17/10/2021, 07:20
General
- Target f273a99eb7aecf6bd55ed85a63b02ae1.exe
- Size 426KB
- Sample211017-h54rdacdh5
- SHA256 f2ae124bb124c6428d2c2d4c1211b7770a8a171f1500c04d3bd59a38f91f4b65
Malware Config
Extracted
-
redline
-
paladin
-
37.228.129.48:29795
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f273a99eb7aecf6bd55ed85a63b02ae1.exe"C:\Users\Admin\AppData\Local\Temp\f273a99eb7aecf6bd55ed85a63b02ae1.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3464-115-0x0000000000A19000-0x0000000000A41000-memory.dmp
memory/3464-116-0x00000000025D0000-0x00000000025FF000-memory.dmp
memory/3464-117-0x0000000000860000-0x00000000009AA000-memory.dmp
memory/3464-118-0x0000000000400000-0x000000000079C000-memory.dmp
memory/3464-119-0x0000000002650000-0x0000000002651000-memory.dmp
memory/3464-120-0x0000000002652000-0x0000000002653000-memory.dmp
memory/3464-122-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3464-121-0x0000000002653000-0x0000000002654000-memory.dmp
memory/3464-123-0x00000000027A0000-0x00000000027CE000-memory.dmp
memory/3464-124-0x0000000005AA0000-0x0000000005AA1000-memory.dmp
memory/3464-125-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3464-126-0x0000000005490000-0x0000000005491000-memory.dmp
memory/3464-127-0x0000000002990000-0x0000000002991000-memory.dmp
memory/3464-128-0x0000000002654000-0x0000000002656000-memory.dmp
memory/3464-129-0x0000000002A10000-0x0000000002A11000-memory.dmp