Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23-03-2022 06:26
Behavioral task
behavioral1
Sample
b7a2b920675c8bef9335ba279317eb15ddfa6961feccc08c1a99e3d2ff8e34c1.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
b7a2b920675c8bef9335ba279317eb15ddfa6961feccc08c1a99e3d2ff8e34c1.exe
-
Size
172KB
-
MD5
bbc9b2e32cd420063e28f97a2c0120e5
-
SHA1
0e8253c7f0d1d82ad299e3301b12f649c7074297
-
SHA256
b7a2b920675c8bef9335ba279317eb15ddfa6961feccc08c1a99e3d2ff8e34c1
-
SHA512
2e8bf7d5dc406f2b0afd67e2a35805307da8930ace805ceeaff67b33258f2849decdaa59a48e9af9ac66d97803b1d27179e8c803ef86c63864e1aac418759581
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
1
C2
20.53.13.165:3335
Attributes
-
auth_value
7ed907c60301a0aea12a58314db264f5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4360-130-0x0000000000A40000-0x0000000000A70000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4360-130-0x0000000000A40000-0x0000000000A70000-memory.dmpFilesize
192KB
-
memory/4360-131-0x0000000005940000-0x0000000005F58000-memory.dmpFilesize
6.1MB
-
memory/4360-132-0x00000000053E0000-0x00000000053F2000-memory.dmpFilesize
72KB
-
memory/4360-133-0x0000000005510000-0x000000000561A000-memory.dmpFilesize
1.0MB
-
memory/4360-134-0x0000000005480000-0x00000000054BC000-memory.dmpFilesize
240KB