redline | 50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3 | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
22-06-2022 06:04

Sharing

Report Analysis Logs

General

Target

b9e6d401a63b2ed2a60380307506edb8.exe
Size

1.3MB
MD5

b9e6d401a63b2ed2a60380307506edb8
SHA1

be0ec6271f20578ffb2523a8b5c2d3fbf07949e5
SHA256

50fe97e2ed07a016233860ededd36e47c077857d2b14b919a21a5f892a432ea3
SHA512

a0a853b292d2c2ab838c83234756c89c719c2b37ecdebb650f15fb1ef86bbda3d1ee1f3c3c596e9ef27e687b15bc3a40bbce7b66b5919366f0f7bbfb18219fae

Score

10^/10

redline 76 infostealer

Malware Config

Extracted

Family

redline

Botnet

76

C2

139.99.32.83:43199

Attributes

auth_value
44d461325298129ed3c705440f57962c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1336-55-0x0000000000A60000-0x0000000000A80000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\b9e6d401a63b2ed2a60380307506edb8.exe
"C:\Users\Admin\AppData\Local\Temp\b9e6d401a63b2ed2a60380307506edb8.exe"
1⤵
PID:1336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1336-55-0x0000000000A60000-0x0000000000A80000-memory.dmp

Filesize
128KB

Download
memory/1336-56-0x00000000748C0000-0x0000000074E6B000-memory.dmp

Filesize
5.7MB

Download