Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2023, 10:00

General

  • Target

    0x000600000001680a-67.exe

  • Size

    174KB

  • MD5

    900432334b81f307e0a4b12e2b2abf5e

  • SHA1

    912cc5e3aa915ce47fc0870de0505f03584fb901

  • SHA256

    537875a98a5c020a831df3c1a19ae6cde56856ad88c62d8ac817f8c0cf76289e

  • SHA512

    b63d9c64b5214d37cc37d2621cc4dbf5ddff45d92919ee6c1ee51d035ad4554fd503d66357a7896c75b86791d2411cd76fd09962f891170286e425c9c9e55bcb

  • SSDEEP

    3072:WFQKcZz8I0G8rlinnOgoLC+Vd2hE0MA9iL2GJg8e8hG:qQp8I0G8Ji68hE0IL2GG

Malware Config

Extracted

Family

redline

Botnet

jang

C2

77.91.124.82:19071

Attributes
  • auth_value

    662102010afcbe9e22b13116b1c1a088

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000600000001680a-67.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000600000001680a-67.exe"
    1⤵
      PID:4244

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4244-0-0x0000000074D50000-0x0000000075500000-memory.dmp

      Filesize

      7.7MB

    • memory/4244-1-0x0000000000E50000-0x0000000000E80000-memory.dmp

      Filesize

      192KB

    • memory/4244-2-0x000000000B240000-0x000000000B858000-memory.dmp

      Filesize

      6.1MB

    • memory/4244-3-0x000000000ADB0000-0x000000000AEBA000-memory.dmp

      Filesize

      1.0MB

    • memory/4244-5-0x000000000ACF0000-0x000000000AD02000-memory.dmp

      Filesize

      72KB

    • memory/4244-4-0x0000000005890000-0x00000000058A0000-memory.dmp

      Filesize

      64KB

    • memory/4244-6-0x000000000AD50000-0x000000000AD8C000-memory.dmp

      Filesize

      240KB

    • memory/4244-7-0x0000000074D50000-0x0000000075500000-memory.dmp

      Filesize

      7.7MB

    • memory/4244-8-0x0000000005890000-0x00000000058A0000-memory.dmp

      Filesize

      64KB