Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 03:12
Static task
static1
Behavioral task
behavioral1
Sample
7bc6903502a04b379047bb649a5d364c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
7bc6903502a04b379047bb649a5d364c.exe
Resource
win10v2004-20231127-en
General
-
Target
7bc6903502a04b379047bb649a5d364c.exe
-
Size
380KB
-
MD5
7bc6903502a04b379047bb649a5d364c
-
SHA1
4ee8c4a0411b938fc7a2f641905bfa3b276830d5
-
SHA256
65befbbadf131fadbdc58f2760b7135a280632d7efd214433e5b9881cd4e54d0
-
SHA512
448973da37f963f2eb7355d324d546f42f23c67886c715406f125ae5f7ed8ce08a8be8026427519685c1ef3a6c5c77e11feb9334a13115f52ddf73f352339299
-
SSDEEP
6144:5mFqTIk4P+aqUidMUOB/Vq4/7HlM8Xfz22BQO6w:m1PjqUidMUeNq4jxfzw
Malware Config
Extracted
redline
@Germany
185.81.68.115:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2456-3-0x0000000003E00000-0x0000000003E2C000-memory.dmp family_redline behavioral1/memory/2456-8-0x0000000004270000-0x0000000004298000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2456-1-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2456-2-0x0000000003CF0000-0x0000000003D2D000-memory.dmpFilesize
244KB
-
memory/2456-4-0x0000000000400000-0x000000000258A000-memory.dmpFilesize
33.5MB
-
memory/2456-3-0x0000000003E00000-0x0000000003E2C000-memory.dmpFilesize
176KB
-
memory/2456-5-0x0000000006970000-0x00000000069B0000-memory.dmpFilesize
256KB
-
memory/2456-6-0x0000000006970000-0x00000000069B0000-memory.dmpFilesize
256KB
-
memory/2456-7-0x0000000073F50000-0x000000007463E000-memory.dmpFilesize
6.9MB
-
memory/2456-8-0x0000000004270000-0x0000000004298000-memory.dmpFilesize
160KB
-
memory/2456-9-0x0000000000400000-0x000000000258A000-memory.dmpFilesize
33.5MB
-
memory/2456-10-0x0000000073F50000-0x000000007463E000-memory.dmpFilesize
6.9MB