Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 05:21
Static task
static1
Behavioral task
behavioral1
Sample
952debf487041b4e707853b77e457c07c3399fdce8454a8fdbf87eb072c897b7.exe
Resource
win10-en-20210920
0 signatures
0 seconds
General
-
Target
952debf487041b4e707853b77e457c07c3399fdce8454a8fdbf87eb072c897b7.exe
-
Size
406KB
-
MD5
9cb5b1edb98b77cf183cd4880f4116cc
-
SHA1
71ee7e4624c6f3940d059195e62c089ce91d41b0
-
SHA256
952debf487041b4e707853b77e457c07c3399fdce8454a8fdbf87eb072c897b7
-
SHA512
5679357feb3a4f2396641acb8059082047b4f09019d97a155655f452b0c5865a2e0642218a3934be7a7c6f1dec23e87778adb4a80482f696cfac6f472522ff76
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3524-118-0x0000000004B40000-0x0000000004B5F000-memory.dmp family_redline behavioral1/memory/3524-120-0x0000000004C80000-0x0000000004C9D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3524-115-0x0000000002F36000-0x0000000002F59000-memory.dmpFilesize
140KB
-
memory/3524-117-0x0000000000400000-0x0000000002DBD000-memory.dmpFilesize
41.7MB
-
memory/3524-116-0x00000000049C0000-0x00000000049F0000-memory.dmpFilesize
192KB
-
memory/3524-118-0x0000000004B40000-0x0000000004B5F000-memory.dmpFilesize
124KB
-
memory/3524-119-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/3524-120-0x0000000004C80000-0x0000000004C9D000-memory.dmpFilesize
116KB
-
memory/3524-121-0x0000000007BB0000-0x0000000007BB1000-memory.dmpFilesize
4KB
-
memory/3524-122-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3524-123-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/3524-125-0x0000000007500000-0x0000000007501000-memory.dmpFilesize
4KB
-
memory/3524-126-0x00000000076A3000-0x00000000076A4000-memory.dmpFilesize
4KB
-
memory/3524-124-0x00000000076A2000-0x00000000076A3000-memory.dmpFilesize
4KB
-
memory/3524-127-0x00000000076A4000-0x00000000076A6000-memory.dmpFilesize
8KB
-
memory/3524-128-0x0000000007610000-0x0000000007611000-memory.dmpFilesize
4KB
-
memory/3524-129-0x00000000081C0000-0x00000000081C1000-memory.dmpFilesize
4KB