Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 16:32

General

  • Target

    f1fd2e9136b755ccc0e0203addcfdc3661c3fa825e3e751db880194e3fab6ab2.exe

  • Size

    337KB

  • MD5

    7aa61e0a545f454c760b1fd29220eb2d

  • SHA1

    cafa5c0f92c5f75da198f3651b50987a6ba86ca5

  • SHA256

    f1fd2e9136b755ccc0e0203addcfdc3661c3fa825e3e751db880194e3fab6ab2

  • SHA512

    0d37eb07ef2cde5513963c53da3c812bc51184a5e9f4b89796a866d4deff033510a18a2c9e876acb81c5f6a0807e1cd76ba0deb2be7f316565b59ff907ece5bf

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1fd2e9136b755ccc0e0203addcfdc3661c3fa825e3e751db880194e3fab6ab2.exe
    "C:\Users\Admin\AppData\Local\Temp\f1fd2e9136b755ccc0e0203addcfdc3661c3fa825e3e751db880194e3fab6ab2.exe"
    1⤵
      PID:3464

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3464-115-0x0000000003050000-0x000000000319A000-memory.dmp
      Filesize

      1MB

    • memory/3464-116-0x0000000004B60000-0x0000000004B90000-memory.dmp
      Filesize

      192KB

    • memory/3464-117-0x0000000000400000-0x0000000002F1B000-memory.dmp
      Filesize

      43MB

    • memory/3464-118-0x0000000004DB0000-0x0000000004DCF000-memory.dmp
      Filesize

      124KB

    • memory/3464-119-0x00000000075F0000-0x00000000075F1000-memory.dmp
      Filesize

      4KB

    • memory/3464-120-0x0000000007AF0000-0x0000000007B0D000-memory.dmp
      Filesize

      116KB

    • memory/3464-121-0x0000000004F80000-0x0000000004F81000-memory.dmp
      Filesize

      4KB

    • memory/3464-122-0x0000000004F82000-0x0000000004F83000-memory.dmp
      Filesize

      4KB

    • memory/3464-123-0x0000000004F83000-0x0000000004F84000-memory.dmp
      Filesize

      4KB

    • memory/3464-124-0x0000000007B10000-0x0000000007B11000-memory.dmp
      Filesize

      4KB

    • memory/3464-125-0x0000000008180000-0x0000000008181000-memory.dmp
      Filesize

      4KB

    • memory/3464-126-0x00000000081B0000-0x00000000081B1000-memory.dmp
      Filesize

      4KB

    • memory/3464-127-0x00000000082C0000-0x00000000082C1000-memory.dmp
      Filesize

      4KB

    • memory/3464-128-0x0000000004F84000-0x0000000004F86000-memory.dmp
      Filesize

      8KB

    • memory/3464-129-0x0000000008340000-0x0000000008341000-memory.dmp
      Filesize

      4KB