Analysis
-
max time kernel
148s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 11:01
Static task
static1
Behavioral task
behavioral1
Sample
71a4e53282c9615e9c62d3c7439396bfa01bec122c4e42463b94f8c18ee91caf.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
71a4e53282c9615e9c62d3c7439396bfa01bec122c4e42463b94f8c18ee91caf.exe
-
Size
405KB
-
MD5
c72f4db10f24db9d0950d2143470625f
-
SHA1
52c4bb85acd47097a86ffe3e85c807e0bd196b20
-
SHA256
71a4e53282c9615e9c62d3c7439396bfa01bec122c4e42463b94f8c18ee91caf
-
SHA512
54cd762e8d342ee1fe32b72cde8a97bbb6653d9804f3385bf270a31d29041c6b18e5ca6d27ddd6ffc4bfe554dbd672d513bbf3795186bb5d53041c9109730b37
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2132-117-0x0000000004AD0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/2132-121-0x0000000004BC0000-0x0000000004BDD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-116-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/2132-117-0x0000000004AD0000-0x0000000004AEF000-memory.dmpFilesize
124KB
-
memory/2132-118-0x0000000000400000-0x0000000002DBC000-memory.dmpFilesize
41.7MB
-
memory/2132-119-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/2132-120-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/2132-121-0x0000000004BC0000-0x0000000004BDD000-memory.dmpFilesize
116KB
-
memory/2132-122-0x0000000007B40000-0x0000000007B41000-memory.dmpFilesize
4KB
-
memory/2132-123-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/2132-124-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/2132-126-0x0000000007634000-0x0000000007636000-memory.dmpFilesize
8KB
-
memory/2132-125-0x0000000007632000-0x0000000007633000-memory.dmpFilesize
4KB
-
memory/2132-127-0x0000000007633000-0x0000000007634000-memory.dmpFilesize
4KB
-
memory/2132-128-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/2132-129-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB