Analysis
-
max time kernel
145s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 16:43
Static task
static1
Behavioral task
behavioral1
Sample
7aef5a0597b7a2f5e34aedf999680e0e1c43ea2a2e99f376ddba844a2c0c4c36.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
7aef5a0597b7a2f5e34aedf999680e0e1c43ea2a2e99f376ddba844a2c0c4c36.exe
-
Size
419KB
-
MD5
a7f98d049192618175bd7811c2e065ad
-
SHA1
a0ac57da61e4f8d83f8be3fe96498f2c5f1ddd3e
-
SHA256
7aef5a0597b7a2f5e34aedf999680e0e1c43ea2a2e99f376ddba844a2c0c4c36
-
SHA512
ffd4e6c85248ecc5e25f318a77c3f68df53c4a914860f127e239489c7cca8b43f0cedd520480226fdad5f188a0e96193ec7cbc8876bc70ef6e3287f6c587ed7a
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2688-116-0x0000000002740000-0x000000000275F000-memory.dmp family_redline behavioral1/memory/2688-118-0x0000000002AB0000-0x0000000002ACD000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2688-116-0x0000000002740000-0x000000000275F000-memory.dmpFilesize
124KB
-
memory/2688-117-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/2688-118-0x0000000002AB0000-0x0000000002ACD000-memory.dmpFilesize
116KB
-
memory/2688-119-0x0000000000900000-0x00000000009AE000-memory.dmpFilesize
696KB
-
memory/2688-120-0x0000000000400000-0x0000000000898000-memory.dmpFilesize
4.6MB
-
memory/2688-122-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/2688-123-0x0000000005102000-0x0000000005103000-memory.dmpFilesize
4KB
-
memory/2688-121-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/2688-124-0x0000000005103000-0x0000000005104000-memory.dmpFilesize
4KB
-
memory/2688-125-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/2688-126-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/2688-127-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/2688-128-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/2688-129-0x0000000005104000-0x0000000005106000-memory.dmpFilesize
8KB