redline | 0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0 | Triage

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
10-05-2022 15:13

Sharing

Report Analysis Logs

General

Target

1448-64-0x0000000000280000-0x00000000002A0000-memory.exe
Size

128KB
MD5

45776fba0e7012c618d37a47b8cc259d
SHA1

a5101b2a422a8e66d6ea673e803d9035add3a5ed
SHA256

0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0
SHA512

45418e0d76d62631c335069bd7a4f351edc0a6f49227ae32071c1b8a2c2fe2758be7f279e12ed7cb830f2c62c00794980bd856c8ec0002eaf149cedfaf11dba5

Score

10^/10

redline install infostealer

Malware Config

Extracted

Family

redline

Botnet

install

C2

31.41.244.92:6188

Attributes

auth_value
eb23a0ca5a38a3bf1eb16b2f08524f35

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1772-130-0x00000000003D0000-0x00000000003F0000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2632 1772 WerFault.exe 1448-64-0x0000000000280000-0x00000000002A0000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1448-64-0x0000000000280000-0x00000000002A0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1448-64-0x0000000000280000-0x00000000002A0000-memory.exe"
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 772
2⤵
- Program crash
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1772 -ip 1772
1⤵
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-130-0x00000000003D0000-0x00000000003F0000-memory.dmp

Filesize
128KB

Download