Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
10-11-2021 16:36
General
-
Target
f88b6b23fc39e0e445172415bcb4d293.exe
-
Size
252KB
-
MD5
f88b6b23fc39e0e445172415bcb4d293
-
SHA1
13199416888bbb2c7b6c50310848645f8ac12db6
-
SHA256
059b3496851ba1a92fe8005f9f5d764917895f8ffc4780e3d2721daf377e02e9
-
SHA512
64a5b2f83f368875b70e4eaf6b1ea9ea21dedbf15942e4de9f843de3f7350c6c17f847a87da523686c2bb86a1a5bac6999c3e68c2dce58d09b0f910626266ba4
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SomeBody
C2
185.215.113.29:36224
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f88b6b23fc39e0e445172415bcb4d293.exe"C:\Users\Admin\AppData\Local\Temp\f88b6b23fc39e0e445172415bcb4d293.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1604-56-0x00000000002E0000-0x0000000000310000-memory.dmpFilesize
192KB
-
memory/1604-55-0x00000000002B0000-0x00000000002D2000-memory.dmpFilesize
136KB
-
memory/1604-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1604-58-0x0000000000450000-0x000000000046C000-memory.dmpFilesize
112KB
-
memory/1604-59-0x00000000049F1000-0x00000000049F2000-memory.dmpFilesize
4KB
-
memory/1604-60-0x00000000049F2000-0x00000000049F3000-memory.dmpFilesize
4KB
-
memory/1604-61-0x00000000049F3000-0x00000000049F4000-memory.dmpFilesize
4KB
-
memory/1604-62-0x0000000001DD0000-0x0000000001DEB000-memory.dmpFilesize
108KB
-
memory/1604-63-0x00000000049F4000-0x00000000049F6000-memory.dmpFilesize
8KB