Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 17:40
Static task
static1
Behavioral task
behavioral1
Sample
68065ee28d7a65bc443642e0a24da11467a6b366a5c50c1a02e63092fb89897e.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
68065ee28d7a65bc443642e0a24da11467a6b366a5c50c1a02e63092fb89897e.exe
-
Size
337KB
-
MD5
691e2dcd636a76a514942e968366ee43
-
SHA1
43232978574660dfe35f1194bb0c46b5ddef7206
-
SHA256
68065ee28d7a65bc443642e0a24da11467a6b366a5c50c1a02e63092fb89897e
-
SHA512
c356818986f2ce60a65bc91049f9c7c7a3ac96a04793ee3ec7e5b35bfb4cdadc8e11a3e65eafb5b72814086754e2b0a8ab630fa6e58577fe8b3dfc2a195e7016
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
UTS
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-118-0x0000000004D30000-0x0000000004D4F000-memory.dmp family_redline behavioral1/memory/2648-120-0x0000000005140000-0x000000000515D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2648-116-0x00000000031C0000-0x00000000031F0000-memory.dmpFilesize
192KB
-
memory/2648-115-0x0000000003080000-0x00000000030A2000-memory.dmpFilesize
136KB
-
memory/2648-117-0x0000000000400000-0x0000000002F1B000-memory.dmpFilesize
43.1MB
-
memory/2648-118-0x0000000004D30000-0x0000000004D4F000-memory.dmpFilesize
124KB
-
memory/2648-119-0x0000000007780000-0x0000000007781000-memory.dmpFilesize
4KB
-
memory/2648-120-0x0000000005140000-0x000000000515D000-memory.dmpFilesize
116KB
-
memory/2648-122-0x0000000007772000-0x0000000007773000-memory.dmpFilesize
4KB
-
memory/2648-121-0x0000000007770000-0x0000000007771000-memory.dmpFilesize
4KB
-
memory/2648-123-0x0000000007773000-0x0000000007774000-memory.dmpFilesize
4KB
-
memory/2648-124-0x0000000007C80000-0x0000000007C81000-memory.dmpFilesize
4KB
-
memory/2648-125-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/2648-126-0x0000000008290000-0x0000000008291000-memory.dmpFilesize
4KB
-
memory/2648-127-0x0000000007774000-0x0000000007776000-memory.dmpFilesize
8KB
-
memory/2648-128-0x0000000007690000-0x0000000007691000-memory.dmpFilesize
4KB
-
memory/2648-129-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB