Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 07:49
Static task
static1
Behavioral task
behavioral1
Sample
9a6713a12c91895968d56d8da562c5be.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
9a6713a12c91895968d56d8da562c5be.exe
Resource
win10-en-20211014
General
-
Target
9a6713a12c91895968d56d8da562c5be.exe
-
Size
408KB
-
MD5
9a6713a12c91895968d56d8da562c5be
-
SHA1
be85fa2bf02a03efa07c4fa4d5fd5454b12374dc
-
SHA256
d6485482bc33e070ed79ea1af9305fdf3f0da5fda461251887b116a516730abc
-
SHA512
7c927efeb5cbc9c43c8c6822eeb08ae459c334f487266cc578f461fa97dcaa00e94948299aa44b580450c7721e783df6a50c70674abe22c4da2a6a46f21dfaeb
Malware Config
Extracted
redline
PUB
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2756-121-0x0000000002750000-0x000000000276F000-memory.dmp family_redline behavioral2/memory/2756-126-0x00000000028F0000-0x000000000290D000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-118-0x0000000000A75000-0x0000000000A98000-memory.dmpFilesize
140KB
-
memory/2756-119-0x00000000008F0000-0x0000000000A3A000-memory.dmpFilesize
1.3MB
-
memory/2756-120-0x0000000000400000-0x0000000000895000-memory.dmpFilesize
4.6MB
-
memory/2756-121-0x0000000002750000-0x000000000276F000-memory.dmpFilesize
124KB
-
memory/2756-122-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/2756-124-0x0000000005012000-0x0000000005013000-memory.dmpFilesize
4KB
-
memory/2756-123-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/2756-125-0x0000000005013000-0x0000000005014000-memory.dmpFilesize
4KB
-
memory/2756-126-0x00000000028F0000-0x000000000290D000-memory.dmpFilesize
116KB
-
memory/2756-127-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/2756-128-0x0000000002B20000-0x0000000002B21000-memory.dmpFilesize
4KB
-
memory/2756-129-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/2756-130-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/2756-131-0x0000000005014000-0x0000000005016000-memory.dmpFilesize
8KB
-
memory/2756-132-0x0000000005C90000-0x0000000005C91000-memory.dmpFilesize
4KB