Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 05:01
Static task
static1
Behavioral task
behavioral1
Sample
bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd.exe
Resource
win10-en-20211014
0 signatures
0 seconds
General
-
Target
bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd.exe
-
Size
382KB
-
MD5
5be750069809882bb53dbfdb4865dfc0
-
SHA1
cf68b21ce5b9fc861f375a0ae3d891a00fce5925
-
SHA256
bd97477187ac818ff2165bef8d1cdf8778c42111e803ab2b1f42c15c8b5d28cd
-
SHA512
4496c1faebfe5cdb4ec0e2f8078db010876fe5330a71d4d846eba67a73b842ddecda00730076a7e33fbc4c63c868d06ea87d406e15745a80c786fd8d98c4a8a1
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4024-118-0x0000000004CB0000-0x0000000004CCF000-memory.dmp family_redline behavioral1/memory/4024-122-0x0000000004EC0000-0x0000000004EDD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4024-115-0x0000000003136000-0x0000000003159000-memory.dmpFilesize
140KB
-
memory/4024-116-0x0000000002DC0000-0x0000000002F0A000-memory.dmpFilesize
1.3MB
-
memory/4024-117-0x0000000000400000-0x0000000002DB7000-memory.dmpFilesize
41.7MB
-
memory/4024-118-0x0000000004CB0000-0x0000000004CCF000-memory.dmpFilesize
124KB
-
memory/4024-119-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/4024-120-0x0000000007712000-0x0000000007713000-memory.dmpFilesize
4KB
-
memory/4024-121-0x0000000007720000-0x0000000007721000-memory.dmpFilesize
4KB
-
memory/4024-122-0x0000000004EC0000-0x0000000004EDD000-memory.dmpFilesize
116KB
-
memory/4024-123-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/4024-124-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4024-125-0x00000000075E0000-0x00000000075E1000-memory.dmpFilesize
4KB
-
memory/4024-126-0x0000000007713000-0x0000000007714000-memory.dmpFilesize
4KB
-
memory/4024-127-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/4024-128-0x0000000007714000-0x0000000007716000-memory.dmpFilesize
8KB
-
memory/4024-129-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB