Analysis

  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 20:01

General

  • Target

    5f01a3b2eb5b822970ea0750e556911dc995631b54b8f25ca222c882bd4c6f0a.exe

  • Size

    337KB

  • MD5

    81e640a72d576e716f8c09a0340e8045

  • SHA1

    1eed4bf92b946e1218c3c11db0e5d6a588a1aa95

  • SHA256

    5f01a3b2eb5b822970ea0750e556911dc995631b54b8f25ca222c882bd4c6f0a

  • SHA512

    48db6293af95d7aceb2cc0dcafb843585da31af51e63c1301a07598c279bf590b0ebfff84386fd621b471d64559759f433724b93afe0b122360e646198ac6a2e

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f01a3b2eb5b822970ea0750e556911dc995631b54b8f25ca222c882bd4c6f0a.exe
    "C:\Users\Admin\AppData\Local\Temp\5f01a3b2eb5b822970ea0750e556911dc995631b54b8f25ca222c882bd4c6f0a.exe"
    1⤵
      PID:3784

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3784-117-0x0000000004B50000-0x0000000004B80000-memory.dmp
      Filesize

      192KB

    • memory/3784-116-0x0000000004B20000-0x0000000004B42000-memory.dmp
      Filesize

      136KB

    • memory/3784-118-0x0000000000400000-0x0000000002F1B000-memory.dmp
      Filesize

      43.1MB

    • memory/3784-119-0x0000000004D60000-0x0000000004D7F000-memory.dmp
      Filesize

      124KB

    • memory/3784-120-0x00000000074D0000-0x00000000074D1000-memory.dmp
      Filesize

      4KB

    • memory/3784-121-0x0000000007470000-0x000000000748D000-memory.dmp
      Filesize

      116KB

    • memory/3784-122-0x00000000079D0000-0x00000000079D1000-memory.dmp
      Filesize

      4KB

    • memory/3784-123-0x0000000008040000-0x0000000008041000-memory.dmp
      Filesize

      4KB

    • memory/3784-124-0x0000000008070000-0x0000000008071000-memory.dmp
      Filesize

      4KB

    • memory/3784-125-0x0000000008180000-0x0000000008181000-memory.dmp
      Filesize

      4KB

    • memory/3784-126-0x00000000074C0000-0x00000000074C1000-memory.dmp
      Filesize

      4KB

    • memory/3784-128-0x00000000074C3000-0x00000000074C4000-memory.dmp
      Filesize

      4KB

    • memory/3784-127-0x00000000074C2000-0x00000000074C3000-memory.dmp
      Filesize

      4KB

    • memory/3784-129-0x00000000074C4000-0x00000000074C6000-memory.dmp
      Filesize

      8KB

    • memory/3784-130-0x0000000008200000-0x0000000008201000-memory.dmp
      Filesize

      4KB