Analysis
- max time kernel
119s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
22/10/2021, 19:33
General
- Target c38636896afd2bff5af0a8c641a50e0f.exe
- Size 441KB
- Sample211022-x9hr2adaal
- SHA256 351b7b183ee55d280acfffc23886ef74efd76873d508704336bb782d84176f90
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c38636896afd2bff5af0a8c641a50e0f.exe"C:\Users\Admin\AppData\Local\Temp\c38636896afd2bff5af0a8c641a50e0f.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2656-115-0x0000000000B76000-0x0000000000BA2000-memory.dmp
memory/2656-117-0x0000000000400000-0x000000000089D000-memory.dmp
memory/2656-116-0x0000000000980000-0x0000000000ACA000-memory.dmp
memory/2656-118-0x0000000002750000-0x000000000277D000-memory.dmp
memory/2656-119-0x0000000005200000-0x0000000005201000-memory.dmp
memory/2656-121-0x00000000051F2000-0x00000000051F3000-memory.dmp
memory/2656-120-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/2656-122-0x00000000051F3000-0x00000000051F4000-memory.dmp
memory/2656-123-0x0000000002790000-0x00000000027BB000-memory.dmp
memory/2656-124-0x0000000005700000-0x0000000005701000-memory.dmp
memory/2656-125-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/2656-126-0x0000000005060000-0x0000000005061000-memory.dmp
memory/2656-127-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/2656-128-0x00000000051F4000-0x00000000051F6000-memory.dmp
memory/2656-129-0x0000000005D10000-0x0000000005D11000-memory.dmp
memory/2656-130-0x0000000005E60000-0x0000000005E61000-memory.dmp
memory/2656-131-0x0000000005EE0000-0x0000000005EE1000-memory.dmp
memory/2656-132-0x00000000061E0000-0x00000000061E1000-memory.dmp
memory/2656-133-0x0000000006260000-0x0000000006261000-memory.dmp