Analysis

  • max time kernel
    290s
  • max time network
    306s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-08-2023 04:51

General

  • Target

    i4010428.exe

  • Size

    174KB

  • MD5

    33abc9f104e93cb1167ecaeb6aa5619a

  • SHA1

    2b55dd7048e24eb85932988ac20e05bba02b3db1

  • SHA256

    cd3d877fb255cf900906bb2a47fbeac5cf79d44cfe6bf3d479c81ac7e11711ae

  • SHA512

    14fe6ffae1f0fd836f1343e61fa01331df6582195236df9b43398ef02404be1e84f645b448fe90c02ab3b08cf647982d7ab362d91d7d7859b0a82bd89e5955ed

  • SSDEEP

    3072:jzyDoUefdkPI0iGEndlOzQnvqmqtlMyNhE04ys4x7sJo8e8hy:fHUjPI0iGEnd2msDNhE09x7su

Malware Config

Extracted

Family

redline

Botnet

jonka

C2

77.91.124.73:19071

Attributes
  • auth_value

    c95bc30cd252fa6dff2a19fd78bfab4e

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\i4010428.exe
    "C:\Users\Admin\AppData\Local\Temp\i4010428.exe"
    1⤵
      PID:2040

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2040-122-0x0000000000810000-0x0000000000840000-memory.dmp

      Filesize

      192KB

    • memory/2040-123-0x00000000732F0000-0x00000000739DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-124-0x00000000029D0000-0x00000000029D6000-memory.dmp

      Filesize

      24KB

    • memory/2040-125-0x000000000AAF0000-0x000000000B0F6000-memory.dmp

      Filesize

      6.0MB

    • memory/2040-126-0x000000000A610000-0x000000000A71A000-memory.dmp

      Filesize

      1.0MB

    • memory/2040-127-0x0000000005050000-0x0000000005060000-memory.dmp

      Filesize

      64KB

    • memory/2040-128-0x000000000A540000-0x000000000A552000-memory.dmp

      Filesize

      72KB

    • memory/2040-129-0x000000000A5A0000-0x000000000A5DE000-memory.dmp

      Filesize

      248KB

    • memory/2040-130-0x000000000A720000-0x000000000A76B000-memory.dmp

      Filesize

      300KB

    • memory/2040-131-0x00000000732F0000-0x00000000739DE000-memory.dmp

      Filesize

      6.9MB

    • memory/2040-132-0x0000000005050000-0x0000000005060000-memory.dmp

      Filesize

      64KB