redline | 01219e8918a7d225564744f3b84c417ebdee23639b18901ba2a9fe496c5e9ccd | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-07-2022 02:06

Sharing

Report Analysis Logs

General

Target

353b564e3ca3c1532c28a4ce9e3ca1a8.exe
Size

107KB
MD5

353b564e3ca3c1532c28a4ce9e3ca1a8
SHA1

ae1305cab75d9a4143b3faf347d0c186b16939a5
SHA256

01219e8918a7d225564744f3b84c417ebdee23639b18901ba2a9fe496c5e9ccd
SHA512

54736d963179a2060110d709a81561fa056d051f3bf04a22262c11aefeb9fb26376f9877ca0662d69e39ca3725b4bf874b70e2bd39ae15c52abbf90c5e51c5bc

Score

10^/10

redline 100 infostealer

Malware Config

Extracted

Family

redline

Botnet

100

C2

185.17.0.63:32327

Attributes

auth_value
8c479b82a6164e0a0f7d75dcff4b60b4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1860-54-0x0000000000B40000-0x0000000000B60000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\353b564e3ca3c1532c28a4ce9e3ca1a8.exe
"C:\Users\Admin\AppData\Local\Temp\353b564e3ca3c1532c28a4ce9e3ca1a8.exe"
1⤵
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1860-54-0x0000000000B40000-0x0000000000B60000-memory.dmp

Filesize
128KB

Download
memory/1860-55-0x0000000075E41000-0x0000000075E43000-memory.dmp

Filesize
8KB

Download