Overview

overview

10

Static

static

10

Redline_20...er.exe

windows7_x64

1

Redline_20...er.exe

windows10_x64

1

Redline_20...er.exe

windows10-2004_x64

1

Redline_20...er.exe

windows11_x64

Redline_20...ld.exe

windows7_x64

10

Redline_20...ld.exe

windows10_x64

10

Redline_20...ld.exe

windows10-2004_x64

10

Redline_20...ld.exe

windows11_x64

Redline_20...st.exe

windows7_x64

1

Redline_20...st.exe

windows10_x64

1

Redline_20...st.exe

windows10-2004_x64

1

Redline_20...st.exe

windows11_x64

Redline_20...er.exe

windows7_x64

4

Redline_20...er.exe

windows10_x64

4

Redline_20...er.exe

windows10-2004_x64

4

Redline_20...er.exe

windows11_x64

Redline_20...el.exe

windows7_x64

10

Redline_20...el.exe

windows10_x64

10

Redline_20...el.exe

windows10-2004_x64

10

Redline_20...el.exe

windows11_x64

Redline_20...me.exe

windows7_x64

8

Redline_20...me.exe

windows10_x64

8

Redline_20...me.exe

windows10-2004_x64

8

Redline_20...me.exe

windows11_x64

Redline_20...48.exe

windows7_x64

8

Redline_20...48.exe

windows10_x64

8

Redline_20...48.exe

windows10-2004_x64

8

Redline_20...48.exe

windows11_x64

Redline_20...ar.exe

windows7_x64

1

Redline_20...ar.exe

windows10_x64

1

Redline_20...ar.exe

windows10-2004_x64

1

Redline_20...ar.exe

windows11_x64

Analysis

  • max time kernel
    581s
  • max time network
    593s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    02-07-2022 14:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Redline_2021_stealer-main/Kurome.Builder/build.exe

  • Size

    95KB

  • MD5

    9c35a28aa792b1891ab7eff22a796626

  • SHA1

    dc99121a44891d784416ddc53d7ab91de641f5f6

  • SHA256

    51d29d896304ab866f92d504ea616f05031ff9cc22675883f50ffbaebc19e422

  • SHA512

    3273d1ae6178fb3caa601ef15d40b2899a5d09b1cb4df376e1ecd7b303eaf9b3b7d3352c15317283d85939e91af021cb033fdd16fa0532424476ed571ff114c9

Score
10/10
redlinetest1infostealer

Malware Config

Extracted

Family

redline

Botnet

test1

C2

213.227.155.164:29166

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Builder\build.exe
    "C:\Users\Admin\AppData\Local\Temp\Redline_2021_stealer-main\Kurome.Builder\build.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2096-116-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-117-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-118-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-119-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-120-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-121-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-122-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-123-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-127-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-126-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-128-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-129-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-130-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-125-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-131-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-124-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-132-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-133-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-134-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-136-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-137-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-138-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-140-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-139-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-135-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-141-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-142-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-143-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-144-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-145-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-146-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-147-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-148-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-149-0x0000000000120000-0x000000000013E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2096-150-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-151-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-152-0x0000000005030000-0x0000000005636000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/2096-153-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-155-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-154-0x0000000004930000-0x0000000004942000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2096-157-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-158-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-159-0x0000000004990000-0x00000000049CE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2096-156-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-160-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-161-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-162-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-164-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-168-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-167-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-166-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-165-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-163-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-170-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-169-0x0000000004A20000-0x0000000004A6B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/2096-171-0x0000000004C40000-0x0000000004D4A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2096-172-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-173-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-174-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-175-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-176-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-177-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-179-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-180-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-178-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-184-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-185-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-183-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-182-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2096-181-0x00000000776A0000-0x000000007782E000-memory.dmp
    Filesize

    1.6MB

    Download