redline | 56b5e2bab55db6128f588d860065027c8f01e5abece0ace2c1d73b95c81b4583 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-en-20211208
submitted
29-01-2022 09:52

Sharing

Report Analysis Logs

General

Target

56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A.exe
Size

104KB
MD5

d8c401e48b035837454fd9c4b8dfe3d1
SHA1

50650c0fb8a95e2c13b1f3f708aa87309dde68d0
SHA256

56b5e2bab55db6128f588d860065027c8f01e5abece0ace2c1d73b95c81b4583
SHA512

6fa68652a13dd3ba3edcc3918acdf7d48eb226361a47facc3124a7ba2a631bc37e87bb148916faaf301c91f24bc773dabe84803ee23a02542dd80e83ce2e5743

Score

10^/10

redline privat3 infostealer

Malware Config

Extracted

Family

redline

Botnet

privat3

C2

dorasandeau.xyz:81

teylerityah.xyz:81

leanaengama.xyz:81

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1488-55-0x0000000000C10000-0x0000000000C30000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A.exe
"C:\Users\Admin\AppData\Local\Temp\56B5E2BAB55DB6128F588D860065027C8F01E5ABECE0A.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-55-0x0000000000C10000-0x0000000000C30000-memory.dmp

Filesize
128KB

Download
memory/1488-56-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/1488-57-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download