a697e2651276e7c18f670abf0d8ed4a687cba62457b94aa075f594886d2c7de8

General
Target

a697e2651276e7c18f670abf0d8ed4a687cba62457b94aa075f594886d2c7de8.exe

Filesize

337KB

Completed

21-10-2021 20:23

Score
10/10
MD5

e358427dc9b0549841bea4450497358e

SHA1

6d5debe3a517bbd7c24eab1e9a7515a026cca228

SHA256

a697e2651276e7c18f670abf0d8ed4a687cba62457b94aa075f594886d2c7de8

Malware Config

Extracted

Family redline
Botnet PUB
C2

45.9.20.182:52236

Signatures 2

Filter: none

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1860-118-0x0000000004D10000-0x0000000004D2F000-memory.dmpfamily_redline
    behavioral1/memory/1860-123-0x00000000075B0000-0x00000000075CD000-memory.dmpfamily_redline
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\a697e2651276e7c18f670abf0d8ed4a687cba62457b94aa075f594886d2c7de8.exe
    "C:\Users\Admin\AppData\Local\Temp\a697e2651276e7c18f670abf0d8ed4a687cba62457b94aa075f594886d2c7de8.exe"
    PID:1860
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1860-115-0x0000000004B30000-0x0000000004B53000-memory.dmp

                          • memory/1860-116-0x0000000004B60000-0x0000000004B90000-memory.dmp

                          • memory/1860-117-0x0000000000400000-0x0000000002F1B000-memory.dmp

                          • memory/1860-118-0x0000000004D10000-0x0000000004D2F000-memory.dmp

                          • memory/1860-119-0x0000000007710000-0x0000000007711000-memory.dmp

                          • memory/1860-120-0x0000000007712000-0x0000000007713000-memory.dmp

                          • memory/1860-121-0x0000000007713000-0x0000000007714000-memory.dmp

                          • memory/1860-122-0x0000000007720000-0x0000000007721000-memory.dmp

                          • memory/1860-123-0x00000000075B0000-0x00000000075CD000-memory.dmp

                          • memory/1860-124-0x0000000007C20000-0x0000000007C21000-memory.dmp

                          • memory/1860-125-0x0000000007660000-0x0000000007661000-memory.dmp

                          • memory/1860-126-0x0000000008230000-0x0000000008231000-memory.dmp

                          • memory/1860-127-0x0000000007690000-0x0000000007691000-memory.dmp

                          • memory/1860-128-0x0000000008340000-0x0000000008341000-memory.dmp

                          • memory/1860-129-0x0000000007714000-0x0000000007716000-memory.dmp