Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 10:34
Static task
static1
Behavioral task
behavioral1
Sample
08204edf80d6ea11bfa7860187cd2149.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
08204edf80d6ea11bfa7860187cd2149.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
08204edf80d6ea11bfa7860187cd2149.exe
-
Size
364KB
-
MD5
08204edf80d6ea11bfa7860187cd2149
-
SHA1
d447ce2a738dd371a536795fd4102047f73535f2
-
SHA256
e8c33c941b4c1f754f9d75d7ba2e2b07441421240877adc557f6b0ee75a5ada3
-
SHA512
b24cc1f332db490b800b169cfc97389fe4bdee8b88e7f46afe7ad1c29e86899cb5bba27280dc350ce1ea957b39c465a90bfa5eeb3adf4fc29764364c291fc35d
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
paladin
C2
188.68.201.6:10085
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-58-0x0000000004BD0000-0x0000000004BFF000-memory.dmp family_redline behavioral1/memory/1684-60-0x0000000004C00000-0x0000000004C2E000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-56-0x0000000000280000-0x00000000002C4000-memory.dmpFilesize
272KB
-
memory/1684-55-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/1684-57-0x0000000000400000-0x0000000002F21000-memory.dmpFilesize
43.1MB
-
memory/1684-58-0x0000000004BD0000-0x0000000004BFF000-memory.dmpFilesize
188KB
-
memory/1684-59-0x00000000073D1000-0x00000000073D2000-memory.dmpFilesize
4KB
-
memory/1684-60-0x0000000004C00000-0x0000000004C2E000-memory.dmpFilesize
184KB
-
memory/1684-61-0x00000000073D2000-0x00000000073D3000-memory.dmpFilesize
4KB
-
memory/1684-62-0x00000000073D3000-0x00000000073D4000-memory.dmpFilesize
4KB
-
memory/1684-63-0x00000000073D4000-0x00000000073D6000-memory.dmpFilesize
8KB