Analysis
-
max time kernel
140s -
max time network
163s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 10:34
Static task
static1
Behavioral task
behavioral1
Sample
08204edf80d6ea11bfa7860187cd2149.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
08204edf80d6ea11bfa7860187cd2149.exe
Resource
win10-en-20210920
General
-
Target
08204edf80d6ea11bfa7860187cd2149.exe
-
Size
364KB
-
MD5
08204edf80d6ea11bfa7860187cd2149
-
SHA1
d447ce2a738dd371a536795fd4102047f73535f2
-
SHA256
e8c33c941b4c1f754f9d75d7ba2e2b07441421240877adc557f6b0ee75a5ada3
-
SHA512
b24cc1f332db490b800b169cfc97389fe4bdee8b88e7f46afe7ad1c29e86899cb5bba27280dc350ce1ea957b39c465a90bfa5eeb3adf4fc29764364c291fc35d
Malware Config
Extracted
redline
paladin
188.68.201.6:10085
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1924-115-0x0000000004DD0000-0x0000000004DFF000-memory.dmp family_redline behavioral2/memory/1924-122-0x0000000007610000-0x000000000763E000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-115-0x0000000004DD0000-0x0000000004DFF000-memory.dmpFilesize
188KB
-
memory/1924-116-0x0000000002F80000-0x0000000002FA9000-memory.dmpFilesize
164KB
-
memory/1924-117-0x0000000002FD0000-0x000000000311A000-memory.dmpFilesize
1.3MB
-
memory/1924-118-0x0000000000400000-0x0000000002F21000-memory.dmpFilesize
43.1MB
-
memory/1924-119-0x0000000007712000-0x0000000007713000-memory.dmpFilesize
4KB
-
memory/1924-120-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/1924-121-0x0000000007720000-0x0000000007721000-memory.dmpFilesize
4KB
-
memory/1924-122-0x0000000007610000-0x000000000763E000-memory.dmpFilesize
184KB
-
memory/1924-123-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/1924-124-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/1924-125-0x0000000008230000-0x0000000008231000-memory.dmpFilesize
4KB
-
memory/1924-127-0x0000000008340000-0x0000000008341000-memory.dmpFilesize
4KB
-
memory/1924-128-0x0000000007714000-0x0000000007716000-memory.dmpFilesize
8KB
-
memory/1924-126-0x0000000007713000-0x0000000007714000-memory.dmpFilesize
4KB
-
memory/1924-129-0x0000000008390000-0x0000000008391000-memory.dmpFilesize
4KB