Analysis
-
max time kernel
217s -
max time network
249s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
05-12-2022 13:48
General
-
Target
8b08fce2936c8363994dda1d6e9ddadf.exe
-
Size
175KB
-
MD5
8b08fce2936c8363994dda1d6e9ddadf
-
SHA1
15cfdfe6e406c0e69d2e6261b898b97eed6f34e2
-
SHA256
3f665abde637a3c65e46e96daeb9aa15c8dda5e2ed2fee15048d4fa790e66991
-
SHA512
925ad9dbe1681a3494450978217c0dd98b637e681a9713280756908f444bef95cf9b9649aa80383561ec59b5951885901b16227e9853c1111a4271ab8e1d0b67
-
SSDEEP
3072:RxqZWPTa9ApGv8fdUTeuWFXhITxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwH:DqZv8fG2Xh
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
Wish
C2
31.41.244.14:4694
Attributes
-
auth_value
836b5b05c28f01127949ef1e84b93e92
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b08fce2936c8363994dda1d6e9ddadf.exe"C:\Users\Admin\AppData\Local\Temp\8b08fce2936c8363994dda1d6e9ddadf.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1404-132-0x0000000000D20000-0x0000000000D52000-memory.dmpFilesize
200KB
-
memory/1404-133-0x0000000005CA0000-0x00000000062B8000-memory.dmpFilesize
6.1MB
-
memory/1404-134-0x00000000057B0000-0x00000000058BA000-memory.dmpFilesize
1.0MB
-
memory/1404-135-0x00000000056E0000-0x00000000056F2000-memory.dmpFilesize
72KB
-
memory/1404-136-0x0000000005740000-0x000000000577C000-memory.dmpFilesize
240KB
-
memory/1404-137-0x0000000006360000-0x00000000063F2000-memory.dmpFilesize
584KB
-
memory/1404-138-0x00000000069B0000-0x0000000006F54000-memory.dmpFilesize
5.6MB
-
memory/1404-139-0x0000000006570000-0x00000000065D6000-memory.dmpFilesize
408KB