Analysis
-
max time kernel
132s -
max time network
173s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
19-10-2021 05:21
Static task
static1
Behavioral task
behavioral1
Sample
0f7db123d145142719c707374a5848a4.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0f7db123d145142719c707374a5848a4.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
0f7db123d145142719c707374a5848a4.exe
-
Size
808KB
-
MD5
0f7db123d145142719c707374a5848a4
-
SHA1
b2a03dbf263d4a50caf841fbb00ffa8f0f071ee1
-
SHA256
579214390f165480aa3ff4991f1a6eb8b6d946dc02e9ecc075a7b816e9ffdfba
-
SHA512
0e5e7dd009452dbb7e32ee34f65e4a2336f20ca19f596c3ba82131d130a0ce9bf6b7f15e4258de1f1eb5b932f9b499e95bf15c05dd096d0160427d3161f744c1
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
01
C2
176.57.71.68:37814
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1256-54-0x0000000000380000-0x00000000003B1000-memory.dmp family_redline behavioral1/memory/1256-60-0x0000000002200000-0x000000000221C000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-54-0x0000000000380000-0x00000000003B1000-memory.dmpFilesize
196KB
-
memory/1256-60-0x0000000002200000-0x000000000221C000-memory.dmpFilesize
112KB
-
memory/1256-62-0x0000000004BF1000-0x0000000004BF2000-memory.dmpFilesize
4KB
-
memory/1256-63-0x0000000004BF2000-0x0000000004BF3000-memory.dmpFilesize
4KB
-
memory/1256-64-0x0000000004BF4000-0x0000000004BF5000-memory.dmpFilesize
4KB