Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2023, 09:05

General

  • Target

    0x0006000000014122-116.exe

  • Size

    145KB

  • MD5

    f51d164aaca43ad8dc88fe0c0ab8f4a6

  • SHA1

    debed4bd8754bb7b91dc57affd188e88911c90ad

  • SHA256

    c93d8757c8ae9a66a024594a16bec196de427690c2392f015f99288b3add75c5

  • SHA512

    3e29c6b32d50fb559d5ad61b014fd67e0f4b6ea7e297132a42e1ecce3efdb8fb4d38d2f38d2f0e2e848d0f52fed4030989b77332e18f92125ebb89a19f6882b3

  • SSDEEP

    3072:sV+m5c/QmRSNY7WKA7vGJv3xnhMZx8e8hp:sj2BUanhMb

Malware Config

Extracted

Family

redline

Botnet

dream

C2

77.91.68.253:4138

Attributes
  • auth_value

    7b4f26a4ca794e30cee1032d5cb62f5c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0006000000014122-116.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0006000000014122-116.exe"
    1⤵
      PID:2680

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2680-133-0x0000000000420000-0x000000000044A000-memory.dmp

      Filesize

      168KB

    • memory/2680-134-0x00000000052F0000-0x0000000005908000-memory.dmp

      Filesize

      6.1MB

    • memory/2680-135-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

      Filesize

      1.0MB

    • memory/2680-136-0x0000000002930000-0x0000000002942000-memory.dmp

      Filesize

      72KB

    • memory/2680-137-0x0000000005080000-0x0000000005090000-memory.dmp

      Filesize

      64KB

    • memory/2680-138-0x0000000004D10000-0x0000000004D4C000-memory.dmp

      Filesize

      240KB

    • memory/2680-139-0x0000000005080000-0x0000000005090000-memory.dmp

      Filesize

      64KB