Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
05/08/2023, 10:51
General
-
Target
5b93942465bff28e02ab3ea10ed41bdfaa8dca92eb9a32b45424693b5a453414.exe
-
Size
364KB
-
MD5
2bd9fc2608f0c06e7be8ca9ada2abad8
-
SHA1
da90b849a7ed5467abf2fa2fd8942d190e54a895
-
SHA256
5b93942465bff28e02ab3ea10ed41bdfaa8dca92eb9a32b45424693b5a453414
-
SHA512
e809b1106ce709b5daf80bd822952e328876a2ec78d2c5ebea9f3787ccfd2b4c217478878a22abae08b8b548020d95758c464deb66d039f59886cebf143907ee
-
SSDEEP
6144:BcsLzhTO6+VrSHRg6hoHYhXyJ8pJ6QIqV1ZHtrhq35BJqfpjS7w:WsLzxOlmxDMYhimf6xqV1ZHtkJBMxjM
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
MY
C2
93.115.18.245:35200
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b93942465bff28e02ab3ea10ed41bdfaa8dca92eb9a32b45424693b5a453414.exe"C:\Users\Admin\AppData\Local\Temp\5b93942465bff28e02ab3ea10ed41bdfaa8dca92eb9a32b45424693b5a453414.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
212KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
184KB
-
Filesize
256KB
-
Filesize
184KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
212KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
73.8MB
-
Filesize
256KB