Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 23:51
Static task
static1
Behavioral task
behavioral1
Sample
b93c42fcc0db63acf075b2fa0e87558610197d0dd836ef074cf5a7a267afe0b5.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
b93c42fcc0db63acf075b2fa0e87558610197d0dd836ef074cf5a7a267afe0b5.exe
-
Size
358KB
-
MD5
2f7bfcf0d8d3cfdd955924676a3de9bf
-
SHA1
a340e2bf7f656fa0986aa03afd3b82e79a79833a
-
SHA256
b93c42fcc0db63acf075b2fa0e87558610197d0dd836ef074cf5a7a267afe0b5
-
SHA512
34a76e689a79ecb0073a40c5423abf08d60707d759a3c675d25fae16639ca19c8120792734304d25b7b05d53dc5b410c2a4d3903be9953d878ce420a83bbcf2e
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3804-116-0x0000000002750000-0x000000000276F000-memory.dmp family_redline behavioral1/memory/3804-118-0x00000000027F0000-0x000000000280D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3804-115-0x0000000000B21000-0x0000000000B44000-memory.dmpFilesize
140KB
-
memory/3804-116-0x0000000002750000-0x000000000276F000-memory.dmpFilesize
124KB
-
memory/3804-117-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/3804-118-0x00000000027F0000-0x000000000280D000-memory.dmpFilesize
116KB
-
memory/3804-119-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/3804-120-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/3804-121-0x0000000000400000-0x0000000000889000-memory.dmpFilesize
4.5MB
-
memory/3804-124-0x0000000000B03000-0x0000000000B04000-memory.dmpFilesize
4KB
-
memory/3804-123-0x0000000000B02000-0x0000000000B03000-memory.dmpFilesize
4KB
-
memory/3804-122-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/3804-125-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/3804-126-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/3804-127-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/3804-128-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/3804-129-0x0000000000B04000-0x0000000000B06000-memory.dmpFilesize
8KB