Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 11:41
Static task
static1
Behavioral task
behavioral1
Sample
3b5a362e681f9af1ffc613f9e5058dded118a2c73548994eef608e9e96bc7ef5.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
3b5a362e681f9af1ffc613f9e5058dded118a2c73548994eef608e9e96bc7ef5.exe
-
Size
337KB
-
MD5
03cf10c8a781e3389653a0a2b166a91f
-
SHA1
d87393ce91eddc40331da55ccdd9e33ee960f7ba
-
SHA256
3b5a362e681f9af1ffc613f9e5058dded118a2c73548994eef608e9e96bc7ef5
-
SHA512
53783ba98794fc29ead33a2bb1ee20b7b7a45121e9fd7ce9b951ed26222c6e9a25fc73527441c6f97380ecd040709db14edb814da6cbc4b853c13d0cd7907aad
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UDP
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2748-118-0x0000000004FB0000-0x0000000004FCF000-memory.dmp family_redline behavioral1/memory/2748-120-0x0000000005150000-0x000000000516D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2748-115-0x0000000002FA0000-0x00000000030EA000-memory.dmpFilesize
1.3MB
-
memory/2748-116-0x0000000002FA0000-0x00000000030EA000-memory.dmpFilesize
1.3MB
-
memory/2748-117-0x0000000000400000-0x0000000002F1B000-memory.dmpFilesize
43.1MB
-
memory/2748-118-0x0000000004FB0000-0x0000000004FCF000-memory.dmpFilesize
124KB
-
memory/2748-119-0x0000000007840000-0x0000000007841000-memory.dmpFilesize
4KB
-
memory/2748-120-0x0000000005150000-0x000000000516D000-memory.dmpFilesize
116KB
-
memory/2748-121-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/2748-123-0x0000000007833000-0x0000000007834000-memory.dmpFilesize
4KB
-
memory/2748-122-0x0000000007832000-0x0000000007833000-memory.dmpFilesize
4KB
-
memory/2748-124-0x0000000007D40000-0x0000000007D41000-memory.dmpFilesize
4KB
-
memory/2748-125-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/2748-126-0x0000000007700000-0x0000000007701000-memory.dmpFilesize
4KB
-
memory/2748-127-0x0000000007834000-0x0000000007836000-memory.dmpFilesize
8KB
-
memory/2748-128-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/2748-129-0x0000000008350000-0x0000000008351000-memory.dmpFilesize
4KB