Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 21:02

General

  • Target

    1d3958ea0a35188af0c216be146a09585e3695511b9c6e22c48e657f555faa86.exe

  • Size

    337KB

  • MD5

    2901a865211dfe25623528d845231427

  • SHA1

    db53cda461fc151d50dc5a0c9e32f315538577c5

  • SHA256

    1d3958ea0a35188af0c216be146a09585e3695511b9c6e22c48e657f555faa86

  • SHA512

    a3aa76152a2edca14f7edf72ed7fe9d76d32b5c5fc65f7824c8fa2a36261e2c8edf5f4a2ce12777c82277ae562f0e3de7e17623fd914ddab3e5ff10d482fd3d7

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d3958ea0a35188af0c216be146a09585e3695511b9c6e22c48e657f555faa86.exe
    "C:\Users\Admin\AppData\Local\Temp\1d3958ea0a35188af0c216be146a09585e3695511b9c6e22c48e657f555faa86.exe"
    1⤵
      PID:2684

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2684-116-0x0000000003070000-0x0000000003093000-memory.dmp
      Filesize

      140KB

    • memory/2684-117-0x0000000004B40000-0x0000000004B70000-memory.dmp
      Filesize

      192KB

    • memory/2684-118-0x0000000000400000-0x0000000002F1B000-memory.dmp
      Filesize

      43.1MB

    • memory/2684-119-0x00000000050A0000-0x00000000050A1000-memory.dmp
      Filesize

      4KB

    • memory/2684-120-0x00000000050C0000-0x00000000050DF000-memory.dmp
      Filesize

      124KB

    • memory/2684-121-0x00000000075B0000-0x00000000075B1000-memory.dmp
      Filesize

      4KB

    • memory/2684-123-0x0000000007AC0000-0x0000000007ADD000-memory.dmp
      Filesize

      116KB

    • memory/2684-122-0x00000000050A2000-0x00000000050A3000-memory.dmp
      Filesize

      4KB

    • memory/2684-124-0x00000000050A3000-0x00000000050A4000-memory.dmp
      Filesize

      4KB

    • memory/2684-125-0x0000000007AE0000-0x0000000007AE1000-memory.dmp
      Filesize

      4KB

    • memory/2684-126-0x0000000008180000-0x0000000008181000-memory.dmp
      Filesize

      4KB

    • memory/2684-127-0x00000000081B0000-0x00000000081B1000-memory.dmp
      Filesize

      4KB

    • memory/2684-128-0x00000000050A4000-0x00000000050A6000-memory.dmp
      Filesize

      8KB

    • memory/2684-129-0x00000000082C0000-0x00000000082C1000-memory.dmp
      Filesize

      4KB

    • memory/2684-130-0x0000000008340000-0x0000000008341000-memory.dmp
      Filesize

      4KB