Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2023 07:05
Behavioral task
behavioral1
Sample
0x0007000000023222-381.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0x0007000000023222-381.exe
Resource
win10v2004-20230915-en
General
-
Target
0x0007000000023222-381.exe
-
Size
222KB
-
MD5
4efc0d118a80d9e01765d803b8a2cf61
-
SHA1
70ef64b40c65b03a1e98afb0b842959464b30cae
-
SHA256
42e02486e940d9b85523ad4382cf67d2924f552bc15d919f77b9a3fd1dfa4f03
-
SHA512
f3b84c830c954c417a454028aad4b30949b41690e451dbd7aa58c40c73f49e41e3a14666090b76894ee8bbe7647e24797b32833417bc6959fa143ada8c59f948
-
SSDEEP
3072:yFyOHrnNNgchKkRm8pyUDv8ZTYllt/q0ePfm/lpvSLaeG:yFyOLNNgch5k80UDGYp/mPfmdJSLa
Malware Config
Extracted
redline
lutyr
77.91.124.55:19071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1148-0-0x0000000000710000-0x000000000074E000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-0-0x0000000000710000-0x000000000074E000-memory.dmpFilesize
248KB
-
memory/1148-1-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/1148-2-0x0000000007AA0000-0x0000000008044000-memory.dmpFilesize
5.6MB
-
memory/1148-3-0x00000000075D0000-0x0000000007662000-memory.dmpFilesize
584KB
-
memory/1148-4-0x0000000075090000-0x0000000075840000-memory.dmpFilesize
7.7MB
-
memory/1148-5-0x0000000007810000-0x0000000007820000-memory.dmpFilesize
64KB
-
memory/1148-6-0x0000000007680000-0x000000000768A000-memory.dmpFilesize
40KB
-
memory/1148-7-0x0000000008670000-0x0000000008C88000-memory.dmpFilesize
6.1MB
-
memory/1148-8-0x0000000007930000-0x0000000007A3A000-memory.dmpFilesize
1.0MB
-
memory/1148-9-0x0000000007860000-0x0000000007872000-memory.dmpFilesize
72KB
-
memory/1148-10-0x00000000078C0000-0x00000000078FC000-memory.dmpFilesize
240KB
-
memory/1148-11-0x0000000007A40000-0x0000000007A8C000-memory.dmpFilesize
304KB
-
memory/1148-12-0x0000000007810000-0x0000000007820000-memory.dmpFilesize
64KB