Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 05:21
Static task
static1
Behavioral task
behavioral1
Sample
0f7db123d145142719c707374a5848a4.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0f7db123d145142719c707374a5848a4.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
0f7db123d145142719c707374a5848a4.exe
-
Size
808KB
-
MD5
0f7db123d145142719c707374a5848a4
-
SHA1
b2a03dbf263d4a50caf841fbb00ffa8f0f071ee1
-
SHA256
579214390f165480aa3ff4991f1a6eb8b6d946dc02e9ecc075a7b816e9ffdfba
-
SHA512
0e5e7dd009452dbb7e32ee34f65e4a2336f20ca19f596c3ba82131d130a0ce9bf6b7f15e4258de1f1eb5b932f9b499e95bf15c05dd096d0160427d3161f744c1
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
01
C2
176.57.71.68:37814
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1828-115-0x0000000000440000-0x0000000000471000-memory.dmp family_redline behavioral2/memory/1828-121-0x0000000000E30000-0x0000000000E4C000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1828-115-0x0000000000440000-0x0000000000471000-memory.dmpFilesize
196KB
-
memory/1828-121-0x0000000000E30000-0x0000000000E4C000-memory.dmpFilesize
112KB
-
memory/1828-123-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/1828-124-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/1828-126-0x00000000052E2000-0x00000000052E3000-memory.dmpFilesize
4KB
-
memory/1828-125-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1828-127-0x00000000052E3000-0x00000000052E4000-memory.dmpFilesize
4KB
-
memory/1828-128-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/1828-129-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/1828-130-0x0000000006000000-0x0000000006001000-memory.dmpFilesize
4KB
-
memory/1828-131-0x00000000052E4000-0x00000000052E5000-memory.dmpFilesize
4KB
-
memory/1828-132-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/1828-133-0x0000000007AD0000-0x0000000007AD1000-memory.dmpFilesize
4KB