Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
10-12-2023 16:22
Static task
static1
Behavioral task
behavioral1
Sample
7bc6903502a04b379047bb649a5d364c.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
7bc6903502a04b379047bb649a5d364c.exe
Resource
win10v2004-20231130-en
General
-
Target
7bc6903502a04b379047bb649a5d364c.exe
-
Size
380KB
-
MD5
7bc6903502a04b379047bb649a5d364c
-
SHA1
4ee8c4a0411b938fc7a2f641905bfa3b276830d5
-
SHA256
65befbbadf131fadbdc58f2760b7135a280632d7efd214433e5b9881cd4e54d0
-
SHA512
448973da37f963f2eb7355d324d546f42f23c67886c715406f125ae5f7ed8ce08a8be8026427519685c1ef3a6c5c77e11feb9334a13115f52ddf73f352339299
-
SSDEEP
6144:5mFqTIk4P+aqUidMUOB/Vq4/7HlM8Xfz22BQO6w:m1PjqUidMUeNq4jxfzw
Malware Config
Extracted
redline
@Germany
185.81.68.115:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2908-3-0x0000000004140000-0x000000000416C000-memory.dmp family_redline behavioral1/memory/2908-8-0x0000000006880000-0x00000000068A8000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2908-2-0x00000000003C0000-0x00000000003FD000-memory.dmpFilesize
244KB
-
memory/2908-1-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/2908-3-0x0000000004140000-0x000000000416C000-memory.dmpFilesize
176KB
-
memory/2908-4-0x0000000000400000-0x000000000258A000-memory.dmpFilesize
33.5MB
-
memory/2908-7-0x0000000004320000-0x0000000004360000-memory.dmpFilesize
256KB
-
memory/2908-6-0x0000000004320000-0x0000000004360000-memory.dmpFilesize
256KB
-
memory/2908-5-0x0000000004320000-0x0000000004360000-memory.dmpFilesize
256KB
-
memory/2908-8-0x0000000006880000-0x00000000068A8000-memory.dmpFilesize
160KB
-
memory/2908-9-0x00000000741F0000-0x00000000748DE000-memory.dmpFilesize
6.9MB
-
memory/2908-11-0x00000000741F0000-0x00000000748DE000-memory.dmpFilesize
6.9MB
-
memory/2908-10-0x0000000000400000-0x000000000258A000-memory.dmpFilesize
33.5MB