Overview

overview

10

Static

static

10

21c63293a1...46.exe

windows7-x64

10

21c63293a1...46.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2022 09:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    21c63293a13296dc293a0e5a775b0146.exe

  • Size

    97KB

  • MD5

    21c63293a13296dc293a0e5a775b0146

  • SHA1

    e9f7665b02c8e44f3b80ed4fd28816201cda89da

  • SHA256

    50cf840ea1c68345adb398c5c3f33fcbadd750a095b5687d7a5735aab7088824

  • SHA512

    393263f08d45c5fe676ffe1b5d7958d7211349ba63835ca33fb878e2c5ba149c86b9aeee32f8e8b5ec07a008f2e3be41467ec4fc42237b5a6427b3cb2c6cacea

  • SSDEEP

    1536:yj1yw39pOq7JkjAYOrOyitVC7uMqBcQjloJQYr4hUndpAz+WTxXv/K:yj1yk0AYQOyiRwOIihUndpFWV/S

Score
10/10
redlinengondungvaoinfostealer

Malware Config

Extracted

Family

redline

Botnet

NGONDUNGVAO

C2

103.74.103.52:24343

Attributes
  • auth_value

    c26fcf86ed5f26d2fadc52a8f9ea2e4c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

Processes

  • C:\Users\Admin\AppData\Local\Temp\21c63293a13296dc293a0e5a775b0146.exe
    "C:\Users\Admin\AppData\Local\Temp\21c63293a13296dc293a0e5a775b0146.exe"
    1⤵
      PID:1368

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1368-54-0x0000000000850000-0x000000000086E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/1368-55-0x0000000074E41000-0x0000000074E43000-memory.dmp
      Filesize

      8KB

      Download