Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2023, 14:25

General

  • Target

    0x0006000000023094-181.exe

  • Size

    174KB

  • MD5

    1e55d8170d9555325a66ed8da96197a5

  • SHA1

    761cf87954fb05eb77735a4f72982ab5a40b2b0c

  • SHA256

    88822e64655815703e72cbb6328faae2772a5489897d46cde8054899e2df7c31

  • SHA512

    496ac0dbc4449294bc3a2a564b54c25f9ce3125ac81ee0c4fb60716c966401c9efb6dddf594de02a2544c75673e82fba780d1da0bdccd60f3fdd1e5700288705

  • SSDEEP

    3072:2N4iIwQkI086khQO4QGaBGUE0OlO6BAYHJ88e8h+:S47kI086khCUE0KAYHK

Malware Config

Extracted

Family

redline

Botnet

maga

C2

77.91.124.54:19071

Attributes
  • auth_value

    9dd7a0be219be9b6228dc9b4e112b812

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0006000000023094-181.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0006000000023094-181.exe"
    1⤵
      PID:5112

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5112-133-0x0000000000500000-0x0000000000530000-memory.dmp

      Filesize

      192KB

    • memory/5112-134-0x0000000074430000-0x0000000074BE0000-memory.dmp

      Filesize

      7.7MB

    • memory/5112-135-0x00000000055A0000-0x0000000005BB8000-memory.dmp

      Filesize

      6.1MB

    • memory/5112-136-0x0000000005090000-0x000000000519A000-memory.dmp

      Filesize

      1.0MB

    • memory/5112-138-0x0000000004E30000-0x0000000004E40000-memory.dmp

      Filesize

      64KB

    • memory/5112-137-0x0000000004F80000-0x0000000004F92000-memory.dmp

      Filesize

      72KB

    • memory/5112-139-0x0000000004FE0000-0x000000000501C000-memory.dmp

      Filesize

      240KB

    • memory/5112-140-0x0000000074430000-0x0000000074BE0000-memory.dmp

      Filesize

      7.7MB

    • memory/5112-141-0x0000000004E30000-0x0000000004E40000-memory.dmp

      Filesize

      64KB