Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 04:31
Static task
static1
Behavioral task
behavioral1
Sample
657c67d13ef252175da58290b1174defb1cbd3e82103f4c97c76e78bcfb4e2aa.exe
Resource
win10-en-20210920
0 signatures
0 seconds
General
-
Target
657c67d13ef252175da58290b1174defb1cbd3e82103f4c97c76e78bcfb4e2aa.exe
-
Size
381KB
-
MD5
f0347fd1a86ecda31351a3dbeb22f446
-
SHA1
5f2ca07f090f2e0f8844a3dc74a6e00ce998c894
-
SHA256
657c67d13ef252175da58290b1174defb1cbd3e82103f4c97c76e78bcfb4e2aa
-
SHA512
dd15c9019ff166e92537f64d24fb0c6dcae81ba99396f9f49e49054c0c34bd7a302ab536e83b6a61b2efd504039543597185d7222cf62ced6c05ed41578d89a0
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-116-0x00000000073A0000-0x00000000073BF000-memory.dmp family_redline behavioral1/memory/1628-121-0x0000000007420000-0x000000000743D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1628-115-0x0000000003146000-0x0000000003169000-memory.dmpFilesize
140KB
-
memory/1628-116-0x00000000073A0000-0x00000000073BF000-memory.dmpFilesize
124KB
-
memory/1628-117-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/1628-118-0x00000000030F0000-0x0000000003120000-memory.dmpFilesize
192KB
-
memory/1628-119-0x0000000000400000-0x0000000002DB7000-memory.dmpFilesize
41.7MB
-
memory/1628-120-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/1628-121-0x0000000007420000-0x000000000743D000-memory.dmpFilesize
116KB
-
memory/1628-124-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/1628-123-0x00000000074D3000-0x00000000074D4000-memory.dmpFilesize
4KB
-
memory/1628-122-0x00000000074D2000-0x00000000074D3000-memory.dmpFilesize
4KB
-
memory/1628-125-0x0000000007FF0000-0x0000000007FF1000-memory.dmpFilesize
4KB
-
memory/1628-126-0x0000000008020000-0x0000000008021000-memory.dmpFilesize
4KB
-
memory/1628-127-0x0000000008130000-0x0000000008131000-memory.dmpFilesize
4KB
-
memory/1628-128-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB
-
memory/1628-129-0x00000000074D4000-0x00000000074D6000-memory.dmpFilesize
8KB