Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 07:12
Static task
static1
Behavioral task
behavioral1
Sample
c763f829060c47a5f547b6e7e38f6240e45ead1ede62309d6f790bb6e3e0da02.exe
Resource
win10-en-20211014
0 signatures
0 seconds
General
-
Target
c763f829060c47a5f547b6e7e38f6240e45ead1ede62309d6f790bb6e3e0da02.exe
-
Size
405KB
-
MD5
fb5243704e105aef7feea1a77069cd2e
-
SHA1
b0172dcd2566774acb010b8518dc1b0f237d82ce
-
SHA256
c763f829060c47a5f547b6e7e38f6240e45ead1ede62309d6f790bb6e3e0da02
-
SHA512
c9e20735f34d5d2e188d0b56b825d6af8cd9d9d0ea732f13a69f0c5cef1291c2fa67bde8de251b671ff9b91497580d93550a8b3c7594f09d73ac04887e59d7e2
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UDP
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-118-0x0000000004B50000-0x0000000004B6F000-memory.dmp family_redline behavioral1/memory/1656-123-0x0000000004E20000-0x0000000004E3D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-115-0x00000000030C6000-0x00000000030E9000-memory.dmpFilesize
140KB
-
memory/1656-116-0x0000000002FF0000-0x0000000003020000-memory.dmpFilesize
192KB
-
memory/1656-117-0x0000000000400000-0x0000000002DBD000-memory.dmpFilesize
41.7MB
-
memory/1656-118-0x0000000004B50000-0x0000000004B6F000-memory.dmpFilesize
124KB
-
memory/1656-119-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/1656-120-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB
-
memory/1656-121-0x0000000007512000-0x0000000007513000-memory.dmpFilesize
4KB
-
memory/1656-122-0x0000000007513000-0x0000000007514000-memory.dmpFilesize
4KB
-
memory/1656-123-0x0000000004E20000-0x0000000004E3D000-memory.dmpFilesize
116KB
-
memory/1656-124-0x0000000007A20000-0x0000000007A21000-memory.dmpFilesize
4KB
-
memory/1656-125-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/1656-126-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/1656-127-0x0000000008140000-0x0000000008141000-memory.dmpFilesize
4KB
-
memory/1656-128-0x0000000007514000-0x0000000007516000-memory.dmpFilesize
8KB
-
memory/1656-129-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB