Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 01:01
Static task
static1
Behavioral task
behavioral1
Sample
67916dbe9e786e7ce5804fcf4b16915ff4c6c608c971ccc131100c1228a71f89.exe
Resource
win10-en-20210920
0 signatures
0 seconds
General
-
Target
67916dbe9e786e7ce5804fcf4b16915ff4c6c608c971ccc131100c1228a71f89.exe
-
Size
382KB
-
MD5
56bd467e66afa36272d7b0d0fc79aeb8
-
SHA1
2e6ca7543a0e461c83a2437296d6554c7befa452
-
SHA256
67916dbe9e786e7ce5804fcf4b16915ff4c6c608c971ccc131100c1228a71f89
-
SHA512
8f880d0eea1f3af893a6d45b7ec53990df6896c1ee02568864435ab559c47fc50b2b7eecb534e4d359c89405cfb4ab5cd62630ed686806bd8d807e1b854ad5d3
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-117-0x0000000004B10000-0x0000000004B2F000-memory.dmp family_redline behavioral1/memory/1684-119-0x0000000004D90000-0x0000000004DAD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-116-0x0000000002ED0000-0x000000000301A000-memory.dmpFilesize
1.3MB
-
memory/1684-117-0x0000000004B10000-0x0000000004B2F000-memory.dmpFilesize
124KB
-
memory/1684-118-0x00000000073D0000-0x00000000073D1000-memory.dmpFilesize
4KB
-
memory/1684-119-0x0000000004D90000-0x0000000004DAD000-memory.dmpFilesize
116KB
-
memory/1684-120-0x00000000078D0000-0x00000000078D1000-memory.dmpFilesize
4KB
-
memory/1684-121-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/1684-122-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/1684-123-0x0000000000400000-0x0000000002DB7000-memory.dmpFilesize
41.7MB
-
memory/1684-125-0x0000000004AF2000-0x0000000004AF3000-memory.dmpFilesize
4KB
-
memory/1684-124-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/1684-126-0x0000000004AF3000-0x0000000004AF4000-memory.dmpFilesize
4KB
-
memory/1684-127-0x0000000007FF0000-0x0000000007FF1000-memory.dmpFilesize
4KB
-
memory/1684-128-0x0000000004AF4000-0x0000000004AF6000-memory.dmpFilesize
8KB
-
memory/1684-129-0x0000000008070000-0x0000000008071000-memory.dmpFilesize
4KB