Analysis

  • max time kernel
    131s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2023 05:57

General

  • Target

    f4a74294fb587bdf5cf32d2d58aec90458e13c3cdfa2bbdd2ac14722e1c5e4c2_JC.exe

  • Size

    341KB

  • MD5

    28ed735efe313b831d2f81bbcd01336e

  • SHA1

    be28e8f084eed26dc012d8cbc4c49d17f8c6573e

  • SHA256

    f4a74294fb587bdf5cf32d2d58aec90458e13c3cdfa2bbdd2ac14722e1c5e4c2

  • SHA512

    9d069eef85b99af00b9905c58db75be65f7a500c72e19627acabb8f5bbd60268f4bad17b36780dc2e47228b3c67601ea99cfd92d8415102c5b8dd72809ca3f16

  • SSDEEP

    6144:GMqftAm+Fqk4zOw6Fe9232f44SbHsJkwN1a/Ti:pqf+z4K14SbHsJka

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4a74294fb587bdf5cf32d2d58aec90458e13c3cdfa2bbdd2ac14722e1c5e4c2_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\f4a74294fb587bdf5cf32d2d58aec90458e13c3cdfa2bbdd2ac14722e1c5e4c2_JC.exe"
    1⤵
      PID:2068

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2068-0-0x0000000001000000-0x000000000105A000-memory.dmp

      Filesize

      360KB

    • memory/2068-1-0x0000000073F70000-0x000000007465E000-memory.dmp

      Filesize

      6.9MB

    • memory/2068-2-0x0000000007330000-0x0000000007370000-memory.dmp

      Filesize

      256KB

    • memory/2068-3-0x0000000073F70000-0x000000007465E000-memory.dmp

      Filesize

      6.9MB

    • memory/2068-4-0x0000000007330000-0x0000000007370000-memory.dmp

      Filesize

      256KB