Analysis

  • max time kernel
    135s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2023 05:15

General

  • Target

    0x00070000000231ce-181.exe

  • Size

    173KB

  • MD5

    e33c22a3bd7488b84398f59a74b0942f

  • SHA1

    d387fdf7a01f09c0be1280de4534b7ffb971809b

  • SHA256

    d7d94c3e1da62633c96efeb20db2fffdc605a22da260f5dcb559387389291bfe

  • SHA512

    0374999eeded3939da354a788909c7caee68a7104b3ed3c9d7aecccb75665934e7059bb4352a6bdbeffcb1944512e8a2ba1fada58c8b0cd2195a50ded54f0655

  • SSDEEP

    3072:eTS18qdsI0PBESjOvGew8Z88FQE02quBoeaTJ38e8hr:eTSfsI0PBESOZ88FQE0QoeaTR

Malware Config

Extracted

Family

redline

Botnet

dugin

C2

77.91.124.73:19071

Attributes
  • auth_value

    7c3e46e091100fd26a6076996d374c28

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00070000000231ce-181.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00070000000231ce-181.exe"
    1⤵
      PID:1684

    Network

      No results found
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    • 77.91.124.73:19071
      0x00070000000231ce-181.exe
      152 B
      3
    No results found

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1684-54-0x0000000074620000-0x0000000074D0E000-memory.dmp

      Filesize

      6.9MB

    • memory/1684-55-0x00000000011B0000-0x00000000011E0000-memory.dmp

      Filesize

      192KB

    • memory/1684-56-0x0000000000310000-0x0000000000316000-memory.dmp

      Filesize

      24KB

    • memory/1684-57-0x00000000046E0000-0x0000000004720000-memory.dmp

      Filesize

      256KB

    • memory/1684-58-0x0000000074620000-0x0000000074D0E000-memory.dmp

      Filesize

      6.9MB

    • memory/1684-59-0x00000000046E0000-0x0000000004720000-memory.dmp

      Filesize

      256KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.