Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-10-2021 09:26
Static task
static1
Behavioral task
behavioral1
Sample
f5d900a7d0c6e1456e1288ebd57e484483f50efe7d0b6e8bfe844e1551249bed.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
f5d900a7d0c6e1456e1288ebd57e484483f50efe7d0b6e8bfe844e1551249bed.exe
-
Size
418KB
-
MD5
22a10219ba5a59dcaae268f19697a297
-
SHA1
946b829df387c6f4109523f842f95945c9497e69
-
SHA256
f5d900a7d0c6e1456e1288ebd57e484483f50efe7d0b6e8bfe844e1551249bed
-
SHA512
d1bcad205fd0da7e42785eb3a16e06deed0f597ab964dbb4bd34487b5fee19de02c76abe0c795bd7331111607813408fc35aba9e1f940f96d80d7bf7e023d7c8
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3088-119-0x0000000002610000-0x000000000262F000-memory.dmp family_redline behavioral1/memory/3088-121-0x0000000004DC0000-0x0000000004DDD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3088-116-0x0000000000CD0000-0x0000000000D00000-memory.dmpFilesize
192KB
-
memory/3088-117-0x0000000000400000-0x0000000000898000-memory.dmpFilesize
4.6MB
-
memory/3088-118-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3088-119-0x0000000002610000-0x000000000262F000-memory.dmpFilesize
124KB
-
memory/3088-120-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/3088-121-0x0000000004DC0000-0x0000000004DDD000-memory.dmpFilesize
116KB
-
memory/3088-122-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3088-123-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3088-124-0x0000000004FA2000-0x0000000004FA3000-memory.dmpFilesize
4KB
-
memory/3088-125-0x0000000004FA3000-0x0000000004FA4000-memory.dmpFilesize
4KB
-
memory/3088-126-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/3088-127-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/3088-128-0x0000000004FA4000-0x0000000004FA6000-memory.dmpFilesize
8KB
-
memory/3088-129-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB