Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 23:01
Static task
static1
Behavioral task
behavioral1
Sample
49d7f47109dc2f8f8bf217383a4516e774d92e882eac944c4920235897294f32.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
-
Target
49d7f47109dc2f8f8bf217383a4516e774d92e882eac944c4920235897294f32.exe
-
Size
409KB
-
MD5
06fd7c4e3629909afa6ae5b302cf6cd1
-
SHA1
fd540258387bb5a74779ae747b667008bd660ce6
-
SHA256
49d7f47109dc2f8f8bf217383a4516e774d92e882eac944c4920235897294f32
-
SHA512
e38341086f4eb6f1228f50255c06c90c7689f60c1938c98da23e13a6cc14969bd059b6a03412d837c5c2c323522ff989831389a2e191e54b621c542a630c4d59
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-118-0x0000000000E30000-0x0000000000E4F000-memory.dmp family_redline behavioral1/memory/2648-123-0x0000000002740000-0x000000000275D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2648-115-0x0000000000C01000-0x0000000000C24000-memory.dmpFilesize
140KB
-
memory/2648-116-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/2648-117-0x0000000000400000-0x0000000000895000-memory.dmpFilesize
4.6MB
-
memory/2648-118-0x0000000000E30000-0x0000000000E4F000-memory.dmpFilesize
124KB
-
memory/2648-119-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/2648-120-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/2648-121-0x0000000005252000-0x0000000005253000-memory.dmpFilesize
4KB
-
memory/2648-122-0x0000000005253000-0x0000000005254000-memory.dmpFilesize
4KB
-
memory/2648-123-0x0000000002740000-0x000000000275D000-memory.dmpFilesize
116KB
-
memory/2648-124-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2648-125-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/2648-126-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/2648-127-0x0000000005254000-0x0000000005256000-memory.dmpFilesize
8KB
-
memory/2648-128-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/2648-129-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB