Analysis

  • max time kernel
    133s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2023 19:42

General

  • Target

    0x0006000000022e4d-39.exe

  • Size

    222KB

  • MD5

    12d0affbdbcc1072c868aa55757d73b2

  • SHA1

    6c7edddcb64d6fbf1f0f81a796694d1ae72ba861

  • SHA256

    d632089da86548266dc5de87faf6487d0ba2f048ff0d1b455a719040b165f195

  • SHA512

    7db4c7b11f7d7bcccdc4823498beb22c4f19735563d6d846b6a94abf8f219506641ad271f6a2e66c3e80d8f2958075b72d8761600073f92af1572ce70b130dfd

  • SSDEEP

    6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5

Malware Config

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0006000000022e4d-39.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0006000000022e4d-39.exe"
    1⤵
      PID:1768

    Network

      No results found
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    • 77.91.124.86:19084
      0x0006000000022e4d-39.exe
      152 B
      3
    No results found

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1768-0-0x0000000001360000-0x000000000139E000-memory.dmp

      Filesize

      248KB

    • memory/1768-1-0x0000000074EB0000-0x000000007559E000-memory.dmp

      Filesize

      6.9MB

    • memory/1768-2-0x0000000007140000-0x0000000007180000-memory.dmp

      Filesize

      256KB

    • memory/1768-3-0x0000000074EB0000-0x000000007559E000-memory.dmp

      Filesize

      6.9MB

    • memory/1768-4-0x0000000007140000-0x0000000007180000-memory.dmp

      Filesize

      256KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.