Overview

overview

10

Static

static

10

0x00080000...62.exe

windows7-x64

10

0x00080000...62.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    27-03-2023 17:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0x00080000000122f0-1062.exe

  • Size

    175KB

  • MD5

    54f4be01fbf32ac0ab8be1578830ea47

  • SHA1

    0cc99e4c83aa7b134f9df15d15e68ba537acc58c

  • SHA256

    05a2be7f07ccd90a58e585605edd88139ce81ed7af47dacb01e949d67aad42b5

  • SHA512

    6fe0e77fd422906933142f00e3ac0d07d599c22c047d58638bdc62c4cb48f20ce7f43403b609d38f63c39c17a9042dc07ac6a2aa673771e4b6f140690eb9dddb

  • SSDEEP

    3072:0xqZWXragQx+/QpeUyUwUeRH93h2jxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jM:KqZWQpeTnP3h

Score
10/10
redlinegonginfostealer

Malware Config

Extracted

Family

redline

Botnet

gong

C2

193.233.20.33:4125

Attributes
  • auth_value

    16950897b83de3bba9e4de36f06a8c05

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00080000000122f0-1062.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00080000000122f0-1062.exe"
    1⤵
      PID:1920

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1920-54-0x0000000000B40000-0x0000000000B72000-memory.dmp

      Filesize

      200KB

      Download

    • memory/1920-55-0x0000000000940000-0x0000000000980000-memory.dmp

      Filesize

      256KB

      Download

    • memory/1920-56-0x0000000000940000-0x0000000000980000-memory.dmp

      Filesize

      256KB

      Download