Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10-10-2023 03:06
Behavioral task
behavioral1
Sample
0x00060000000231d7-67.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0x00060000000231d7-67.exe
Resource
win10v2004-20230915-en
General
-
Target
0x00060000000231d7-67.exe
-
Size
230KB
-
MD5
b5c1f92ec8130e5ecc3c682e2e04b986
-
SHA1
f61319cf5559f22f813d5750124a827feff8eb44
-
SHA256
e95339e55feb119302641634660c3e5bdbf5419a8d2492e7f4f219d724e305bf
-
SHA512
186b92a91c767319802ecc53a42d8492b6eb977f77e4b100f36b7b205b400fbcbf3b87225ceed7d439a3d5404f08b82421900d6751fbd7c35811aa7f00ff324b
-
SSDEEP
3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2116-0-0x0000000000070000-0x00000000000AE000-memory.dmp family_redline behavioral1/memory/2116-2-0x0000000006F50000-0x0000000006F90000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-0-0x0000000000070000-0x00000000000AE000-memory.dmpFilesize
248KB
-
memory/2116-1-0x0000000074420000-0x0000000074B0E000-memory.dmpFilesize
6.9MB
-
memory/2116-2-0x0000000006F50000-0x0000000006F90000-memory.dmpFilesize
256KB
-
memory/2116-3-0x0000000074420000-0x0000000074B0E000-memory.dmpFilesize
6.9MB
-
memory/2116-4-0x0000000006F50000-0x0000000006F90000-memory.dmpFilesize
256KB