Analysis

  • max time kernel
    138s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 12:08

General

  • Target

    0x0006000000023097-34.exe

  • Size

    174KB

  • MD5

    cd7de4ee3dfd325cbd735cd1d6721ba5

  • SHA1

    d097acf7c9479964794eeb3fbb5bcfabb6c8cce7

  • SHA256

    c180cc0dee4a19ba32b28386657ce8b28badc2b44f6265c49f52a37f74d3cd50

  • SHA512

    7b0d8c35198b27c0786525b2eb1ba460e6d6136cac83fc459bcde5adf87c8a35ca917bf8a8b24ee57c095537906bbc763bfdcb610b79b8d8e08fb5416d306362

  • SSDEEP

    3072:HmVenX0I0V916dOBCymtjvqE0WIkuvwJx8e8hN:Hmq0I0V9161DqE0Vvwn

Malware Config

Extracted

Family

redline

Botnet

luate

C2

77.91.124.55:19071

Attributes
  • auth_value

    e45cd419aba6c9d372088ffe5629308b

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0006000000023097-34.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0006000000023097-34.exe"
    1⤵
      PID:4044

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4044-0-0x00000000751E0000-0x0000000075990000-memory.dmp

            Filesize

            7.7MB

          • memory/4044-1-0x0000000000EC0000-0x0000000000EF0000-memory.dmp

            Filesize

            192KB

          • memory/4044-2-0x00000000058D0000-0x00000000058D6000-memory.dmp

            Filesize

            24KB

          • memory/4044-3-0x0000000005F40000-0x0000000006558000-memory.dmp

            Filesize

            6.1MB

          • memory/4044-4-0x0000000005A30000-0x0000000005B3A000-memory.dmp

            Filesize

            1.0MB

          • memory/4044-5-0x0000000005940000-0x0000000005952000-memory.dmp

            Filesize

            72KB

          • memory/4044-6-0x0000000005910000-0x0000000005920000-memory.dmp

            Filesize

            64KB

          • memory/4044-7-0x00000000059A0000-0x00000000059DC000-memory.dmp

            Filesize

            240KB

          • memory/4044-8-0x00000000059E0000-0x0000000005A2C000-memory.dmp

            Filesize

            304KB

          • memory/4044-9-0x00000000751E0000-0x0000000075990000-memory.dmp

            Filesize

            7.7MB

          • memory/4044-10-0x0000000005910000-0x0000000005920000-memory.dmp

            Filesize

            64KB