Analysis

  • max time kernel
    293s
  • max time network
    300s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    18-09-2023 01:38

General

  • Target

    h8948845.exe

  • Size

    174KB

  • MD5

    bb3d12d155666469b962cad6f5abbed0

  • SHA1

    e7e91770ab81ac717dbd349f3f171ac7934fac89

  • SHA256

    bf6c1e6363a3f06ac378d6ad279b0065f9336538156e31f367a1798bcd69c97c

  • SHA512

    b0fce1e4bf6d72e3031897ff0897fcb086dc00c07b00ade18f4c3770e77532a360a3247f7f7fe45a21ead60627112377185d4b9aeec2deb25c80ecd7d8ad1444

  • SSDEEP

    3072:0GRk2OCSnBI0eVY+UxO5FY+bZHoGAxIcE0MLEXs08JYJw8e8hO:22EBI0eVVU0ZIGACcE0ot08JY2

Malware Config

Extracted

Family

redline

Botnet

petin

C2

77.91.124.82:19071

Attributes
  • auth_value

    f6cf7a48c0291d1ef5a3440429827d6d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\h8948845.exe
    "C:\Users\Admin\AppData\Local\Temp\h8948845.exe"
    1⤵
      PID:1692

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1692-0-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/1692-1-0x0000000001020000-0x0000000001050000-memory.dmp

      Filesize

      192KB

    • memory/1692-2-0x0000000000300000-0x0000000000306000-memory.dmp

      Filesize

      24KB

    • memory/1692-3-0x0000000004810000-0x0000000004850000-memory.dmp

      Filesize

      256KB

    • memory/1692-4-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/1692-5-0x0000000004810000-0x0000000004850000-memory.dmp

      Filesize

      256KB