Analysis
-
max time kernel
150s -
max time network
165s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
03-03-2022 11:09
Behavioral task
behavioral1
Sample
a903b038cc4e1bb726d0c8567c1f7cf41da3208ca97cce4eeb5877a7d9ac7b34.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
a903b038cc4e1bb726d0c8567c1f7cf41da3208ca97cce4eeb5877a7d9ac7b34.exe
-
Size
103KB
-
MD5
e2085b363d82af732a4226309217377b
-
SHA1
a15ad309fa9019f3d32b3509702ffe7eef3096ad
-
SHA256
a903b038cc4e1bb726d0c8567c1f7cf41da3208ca97cce4eeb5877a7d9ac7b34
-
SHA512
49725dd88a92bb11473ce3bae701d08dd89aa0eef8c1b7dea693b06700bbd5bdedcf4aa69d4e2cd1db4e39fd8ce85705c84084286d12af2c9dedd795026feb4f
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
1
C2
103.167.85.6:33424
Attributes
-
auth_value
5f998146df678c7505a1618d5835cd1b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-116-0x0000000000990000-0x00000000009B0000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-115-0x0000000073E7E000-0x0000000073E7F000-memory.dmpFilesize
4KB
-
memory/1664-116-0x0000000000990000-0x00000000009B0000-memory.dmpFilesize
128KB
-
memory/1664-117-0x0000000005AF0000-0x00000000060F6000-memory.dmpFilesize
6.0MB
-
memory/1664-118-0x0000000002BA0000-0x0000000002BB2000-memory.dmpFilesize
72KB
-
memory/1664-119-0x00000000055F0000-0x00000000056FA000-memory.dmpFilesize
1.0MB
-
memory/1664-120-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/1664-121-0x00000000054E0000-0x000000000551E000-memory.dmpFilesize
248KB
-
memory/1664-122-0x0000000005520000-0x000000000556B000-memory.dmpFilesize
300KB