redline | 3ea3a1afd840c994e3da1e6300430671a8c5a8c4048b3370d4d77e48d7593f2b | Triage

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
22-06-2022 06:07

Sharing

Report Analysis Logs

General

Target

1336-55-0x0000000000A60000-0x0000000000A80000-memory.exe
Size

128KB
MD5

44f5a11de3059301102a8f8463a50396
SHA1

6f351a2ea810a85bef7970aca729473c8bc52b59
SHA256

3ea3a1afd840c994e3da1e6300430671a8c5a8c4048b3370d4d77e48d7593f2b
SHA512

edc1288cf2132d20e2fd78d9ebdad6867437cb5e2d08498ccdc9054c7b442f305b426719381f0c02833f6a9abea1668bb8b4705a238aff4c9b5a69be92bfc108

Score

10^/10

redline 76 infostealer

Malware Config

Extracted

Family

redline

Botnet

76

C2

139.99.32.83:43199

Attributes

auth_value
44d461325298129ed3c705440f57962c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1092-54-0x0000000000FA0000-0x0000000000FC0000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\1336-55-0x0000000000A60000-0x0000000000A80000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1336-55-0x0000000000A60000-0x0000000000A80000-memory.exe"
1⤵
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000FA0000-0x0000000000FC0000-memory.dmp

Filesize
128KB

Download
memory/1092-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download