Analysis

  • max time kernel
    161s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 11:05

General

  • Target

    0x0007000000023105-386.exe

  • Size

    231KB

  • MD5

    bdafd3e62949e5fe3eeec6dc1c71a459

  • SHA1

    d0aaa6c7b0b419ada015b2be22525fc5563ae2dd

  • SHA256

    01798ec460b2095c1075713bb4b90e1beedaa04443a18bf30acc44e687998078

  • SHA512

    a8541c527e1e7b3935e8a54dbe9700db2a2cc8ed6544902e031710c629cc5ee588d989dddf9783fff19203047adf019008c94327dab17564f731f3ec89f911f2

  • SSDEEP

    3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK

Malware Config

Extracted

Family

redline

Botnet

gigant

C2

77.91.124.55:19071

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0007000000023105-386.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0007000000023105-386.exe"
    1⤵
      PID:1732

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1732-0-0x0000000000D50000-0x0000000000D8E000-memory.dmp

      Filesize

      248KB

    • memory/1732-1-0x00000000742A0000-0x000000007498E000-memory.dmp

      Filesize

      6.9MB

    • memory/1732-2-0x00000000072D0000-0x0000000007310000-memory.dmp

      Filesize

      256KB

    • memory/1732-3-0x00000000742A0000-0x000000007498E000-memory.dmp

      Filesize

      6.9MB

    • memory/1732-4-0x00000000072D0000-0x0000000007310000-memory.dmp

      Filesize

      256KB