Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 16:32
Static task
static1
Behavioral task
behavioral1
Sample
999a1755fd4d6253b52e46a847404873f7851c119395465b88ecf2c51167aea0.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
999a1755fd4d6253b52e46a847404873f7851c119395465b88ecf2c51167aea0.exe
-
Size
337KB
-
MD5
e84a5dc3e0c680de6a50e5322874cce3
-
SHA1
1b4f1f0b76334892a43231c2e98922979a6bc47c
-
SHA256
999a1755fd4d6253b52e46a847404873f7851c119395465b88ecf2c51167aea0
-
SHA512
6e09dae028ca51baabe0b5182927cb5892c423a95ddd597396b208bde96f4bd4f31eacc8a79232aa8e68edaa9e4539392cec19f7c41208055bd176d7042abc56
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2716-118-0x0000000004DC0000-0x0000000004DDF000-memory.dmp family_redline behavioral1/memory/2716-120-0x0000000004F20000-0x0000000004F3D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2716-116-0x0000000002F70000-0x00000000030BA000-memory.dmpFilesize
1.3MB
-
memory/2716-115-0x0000000002F70000-0x00000000030BA000-memory.dmpFilesize
1.3MB
-
memory/2716-117-0x0000000000400000-0x0000000002F1B000-memory.dmpFilesize
43.1MB
-
memory/2716-118-0x0000000004DC0000-0x0000000004DDF000-memory.dmpFilesize
124KB
-
memory/2716-119-0x0000000007600000-0x0000000007601000-memory.dmpFilesize
4KB
-
memory/2716-120-0x0000000004F20000-0x0000000004F3D000-memory.dmpFilesize
116KB
-
memory/2716-121-0x0000000007B00000-0x0000000007B01000-memory.dmpFilesize
4KB
-
memory/2716-122-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/2716-123-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/2716-124-0x00000000075F2000-0x00000000075F3000-memory.dmpFilesize
4KB
-
memory/2716-126-0x0000000008110000-0x0000000008111000-memory.dmpFilesize
4KB
-
memory/2716-125-0x00000000075F3000-0x00000000075F4000-memory.dmpFilesize
4KB
-
memory/2716-127-0x0000000007550000-0x0000000007551000-memory.dmpFilesize
4KB
-
memory/2716-128-0x0000000008220000-0x0000000008221000-memory.dmpFilesize
4KB
-
memory/2716-129-0x00000000075F4000-0x00000000075F6000-memory.dmpFilesize
8KB