Analysis

  • max time kernel
    135s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 08:10

General

  • Target

    0x00060000000141ec-116.exe

  • Size

    145KB

  • MD5

    b65e3c7c579639f49b60697020caa326

  • SHA1

    8f43e44ee950e627c5aa020e281a93fe2dd56bae

  • SHA256

    77aeafc056ea5b79a7103768edac7911b6e9df8ed425f884edba126f9a832e99

  • SHA512

    bfc0434b4f34c166ffa3294d4705841f58df48fb3f481a7622ad50799ca313ea48ba5ee897f7c4c434ae2459fbf9517d406342bfca2925cab51fa40e5bca0b12

  • SSDEEP

    3072:oV+m5czQmRS9Ynk5QXNhhRbG5h5Zx8e8h/:ojKtM5h5b

Malware Config

Extracted

Family

redline

Botnet

luza

C2

185.161.248.37:4138

Attributes
  • auth_value

    1261701914d508e02e8b4f25d38bc7f9

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00060000000141ec-116.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00060000000141ec-116.exe"
    1⤵
      PID:1920

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1920-133-0x0000000000D40000-0x0000000000D6A000-memory.dmp

            Filesize

            168KB

          • memory/1920-134-0x0000000005C30000-0x0000000006248000-memory.dmp

            Filesize

            6.1MB

          • memory/1920-135-0x00000000057B0000-0x00000000058BA000-memory.dmp

            Filesize

            1.0MB

          • memory/1920-136-0x00000000056E0000-0x00000000056F2000-memory.dmp

            Filesize

            72KB

          • memory/1920-137-0x0000000005A20000-0x0000000005A30000-memory.dmp

            Filesize

            64KB

          • memory/1920-138-0x0000000005740000-0x000000000577C000-memory.dmp

            Filesize

            240KB

          • memory/1920-139-0x0000000005A20000-0x0000000005A30000-memory.dmp

            Filesize

            64KB