Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2023, 15:11

General

  • Target

    0x000700000001313e-119.exe

  • Size

    145KB

  • MD5

    fb6247f354bfeda6c4cbd079423baafb

  • SHA1

    49fe9403d935884a2ccb2f3a31adbd7df9b0cb07

  • SHA256

    9881d3f8852e7778857d746535542532490fe1ea028b39e92bc2b0886f9aed40

  • SHA512

    92bec3f3bd20121efd5eb1ea113ddb3281ea9cab0b68eb5d67519e1d722b1740387a9c324b28ec182e6cbe2ee7a6abdc2ed7bca6a4cbe03cd43151a93261d481

  • SSDEEP

    3072:FV+m5c/QmRSNAwMqLza9nDEFth2ZG8e8hR:Fj2FD0IQth2c

Malware Config

Extracted

Family

redline

Botnet

luna

C2

77.91.68.253:4138

Attributes
  • auth_value

    16dec8addb01db1c11c59667022ef7a2

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000700000001313e-119.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000700000001313e-119.exe"
    1⤵
      PID:2548

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2548-133-0x0000000000F40000-0x0000000000F6A000-memory.dmp

            Filesize

            168KB

          • memory/2548-134-0x0000000005EC0000-0x00000000064D8000-memory.dmp

            Filesize

            6.1MB

          • memory/2548-135-0x00000000059B0000-0x0000000005ABA000-memory.dmp

            Filesize

            1.0MB

          • memory/2548-136-0x0000000005CA0000-0x0000000005CB0000-memory.dmp

            Filesize

            64KB

          • memory/2548-137-0x00000000058E0000-0x00000000058F2000-memory.dmp

            Filesize

            72KB

          • memory/2548-138-0x0000000005940000-0x000000000597C000-memory.dmp

            Filesize

            240KB

          • memory/2548-139-0x0000000005CA0000-0x0000000005CB0000-memory.dmp

            Filesize

            64KB