Analysis

  • max time kernel
    289s
  • max time network
    312s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/07/2023, 00:18

General

  • Target

    l6614226.exe

  • Size

    738KB

  • MD5

    9c0538dfae774f1f869ee65c016e53f4

  • SHA1

    ec5ea7d7929c313b99084f3ac6db048d73583fc7

  • SHA256

    abdeaa026ede79469667520894bd3ffe2460e6025ff80dd7e347723966700302

  • SHA512

    e4d5992fd377b379cd5c6be789bfcd10ec71a57cb070442f2ef4a1da52d23402d5d2457e5e794b203f0f0dcc03213f39e0963687bb9a1627342fcaebebb313dc

  • SSDEEP

    12288:PJ7axF0zTCiICSVtg0wBW3iFt4ONq30/4St2NBd0JoLdaoi9Bbk:P+FS2BbVTb34k30/8dRi9

Malware Config

Extracted

Family

redline

Botnet

kira

C2

77.91.68.48:19071

Attributes
  • auth_value

    1677a40fd8997eb89377e1681911e9c6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\l6614226.exe
    "C:\Users\Admin\AppData\Local\Temp\l6614226.exe"
    1⤵
      PID:2776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2776-117-0x00000000001D0000-0x0000000000200000-memory.dmp

      Filesize

      192KB

    • memory/2776-121-0x0000000004A30000-0x0000000004A36000-memory.dmp

      Filesize

      24KB

    • memory/2776-122-0x0000000009E40000-0x000000000A446000-memory.dmp

      Filesize

      6.0MB

    • memory/2776-123-0x000000000A480000-0x000000000A58A000-memory.dmp

      Filesize

      1.0MB

    • memory/2776-124-0x000000000A5B0000-0x000000000A5C2000-memory.dmp

      Filesize

      72KB

    • memory/2776-125-0x000000000A5D0000-0x000000000A60E000-memory.dmp

      Filesize

      248KB

    • memory/2776-126-0x000000000A680000-0x000000000A6CB000-memory.dmp

      Filesize

      300KB

    • memory/2776-127-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

      Filesize

      64KB

    • memory/2776-128-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

      Filesize

      64KB