Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
ddafaef13d4523e10639b495aeffc82a60d8a21df97c7d24f022826b3a22b220.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
ddafaef13d4523e10639b495aeffc82a60d8a21df97c7d24f022826b3a22b220.exe
-
Size
358KB
-
MD5
9c160abb7c1eb4edfdca4ba6c41b9d83
-
SHA1
34164b516d378077be6cf74603a0b3c5ad75847a
-
SHA256
ddafaef13d4523e10639b495aeffc82a60d8a21df97c7d24f022826b3a22b220
-
SHA512
4bdad219fdb7b62b83dc3863a4e3be8c2fcd39db5f20d73618a66ca167f9ce34a3ab0af815a6c0cccbbd54b5152c8618fe117c9d908529251c64d8444042701c
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3564-118-0x0000000002900000-0x000000000291F000-memory.dmp family_redline behavioral1/memory/3564-120-0x0000000002990000-0x00000000029AD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3564-115-0x0000000000BD6000-0x0000000000BF9000-memory.dmpFilesize
140KB
-
memory/3564-116-0x0000000000CC0000-0x0000000000CF0000-memory.dmpFilesize
192KB
-
memory/3564-117-0x0000000000400000-0x0000000000889000-memory.dmpFilesize
4.5MB
-
memory/3564-118-0x0000000002900000-0x000000000291F000-memory.dmpFilesize
124KB
-
memory/3564-119-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3564-120-0x0000000002990000-0x00000000029AD000-memory.dmpFilesize
116KB
-
memory/3564-121-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/3564-122-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/3564-123-0x0000000005BA0000-0x0000000005BA1000-memory.dmpFilesize
4KB
-
memory/3564-124-0x0000000002A80000-0x0000000002A81000-memory.dmpFilesize
4KB
-
memory/3564-125-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/3564-127-0x00000000026D3000-0x00000000026D4000-memory.dmpFilesize
4KB
-
memory/3564-126-0x00000000026D2000-0x00000000026D3000-memory.dmpFilesize
4KB
-
memory/3564-128-0x00000000026D4000-0x00000000026D6000-memory.dmpFilesize
8KB
-
memory/3564-129-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB