Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
10/12/2023, 16:23
General
-
Target
7bc6903502a04b379047bb649a5d364c.exe
-
Size
380KB
-
MD5
7bc6903502a04b379047bb649a5d364c
-
SHA1
4ee8c4a0411b938fc7a2f641905bfa3b276830d5
-
SHA256
65befbbadf131fadbdc58f2760b7135a280632d7efd214433e5b9881cd4e54d0
-
SHA512
448973da37f963f2eb7355d324d546f42f23c67886c715406f125ae5f7ed8ce08a8be8026427519685c1ef3a6c5c77e11feb9334a13115f52ddf73f352339299
-
SSDEEP
6144:5mFqTIk4P+aqUidMUOB/Vq4/7HlM8Xfz22BQO6w:m1PjqUidMUeNq4jxfzw
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
@Germany
C2
185.81.68.115:2920
Attributes
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc6903502a04b379047bb649a5d364c.exe"C:\Users\Admin\AppData\Local\Temp\7bc6903502a04b379047bb649a5d364c.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 11322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4336 -ip 43361⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
244KB
-
Filesize
176KB
-
Filesize
33.5MB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
33.5MB
-
Filesize
7.7MB
-
Filesize
244KB