Analysis
-
max time kernel
295s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
01/11/2022, 08:44
General
-
Target
23522fc8df71c90aa1264da8540de72d3d569c12fafd6da9be7af11c4f97d318.exe
-
Size
2.4MB
-
MD5
8d73bd6de1591619bba27542933ee911
-
SHA1
00e5657de6feb4bfee3489e564d9605da5f3202e
-
SHA256
23522fc8df71c90aa1264da8540de72d3d569c12fafd6da9be7af11c4f97d318
-
SHA512
118892feb5c5b6aeb2bd7881492fb23bbf509a96e067907931231799ad703362531f34192fef6507ceeab0521ef8e3ec96c8c8e901ee7b77b5e00f2e3b5f4374
-
SSDEEP
24576:J3ZIOaY2Ytzmq4mMdmo6erlHa16JNotj2PV4o5iY3CBLHLKKOmZUl3RuQ55313T:pZICslNotKdViY3CBLH8l3p
Malware Config
Extracted
redline
@foruman
185.106.92.226:40788
-
auth_value
bd15c39173a26033961a0c806b2b4684
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23522fc8df71c90aa1264da8540de72d3d569c12fafd6da9be7af11c4f97d318.exe"C:\Users\Admin\AppData\Local\Temp\23522fc8df71c90aa1264da8540de72d3d569c12fafd6da9be7af11c4f97d318.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
128KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
300KB