Analysis
-
max time kernel
145s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
588230aa59d845a76736e48fb032800cad423ceafaf2f217362e9dcdf719b444.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
588230aa59d845a76736e48fb032800cad423ceafaf2f217362e9dcdf719b444.exe
-
Size
410KB
-
MD5
fa4d623c6912e89e4d47ed142ea9ff2f
-
SHA1
2208038e3a0110a13528795fa082db226bfd6c0e
-
SHA256
588230aa59d845a76736e48fb032800cad423ceafaf2f217362e9dcdf719b444
-
SHA512
2c2cd19bbbefbbe71a399dfa1ac48a3088e082ca47cec8136e58e4a70ddd600596a786006944d48c3c3b5060ef004fc0a776485578d6d036bab5c977868a961b
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
PUB
C2
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2892-118-0x0000000002630000-0x000000000264F000-memory.dmp family_redline behavioral1/memory/2892-120-0x0000000002820000-0x000000000283D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2892-115-0x0000000000C61000-0x0000000000C84000-memory.dmpFilesize
140KB
-
memory/2892-117-0x0000000000400000-0x0000000000895000-memory.dmpFilesize
4.6MB
-
memory/2892-116-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/2892-118-0x0000000002630000-0x000000000264F000-memory.dmpFilesize
124KB
-
memory/2892-119-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/2892-120-0x0000000002820000-0x000000000283D000-memory.dmpFilesize
116KB
-
memory/2892-121-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/2892-122-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/2892-125-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/2892-126-0x0000000005163000-0x0000000005164000-memory.dmpFilesize
4KB
-
memory/2892-124-0x0000000005162000-0x0000000005163000-memory.dmpFilesize
4KB
-
memory/2892-123-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/2892-127-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/2892-128-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB
-
memory/2892-129-0x0000000005164000-0x0000000005166000-memory.dmpFilesize
8KB