Overview

overview

10

Static

static

10

0x00300000...86.exe

windows7-x64

10

0x00300000...86.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2024 19:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0x0030000000015c1b-2186.exe

  • Size

    168KB

  • MD5

    9d86063fc7de11762516c0e39a895cdc

  • SHA1

    ecab5814409a278e305dda153a7a58f4057f282d

  • SHA256

    24ccce9355286d59cbb8fefc1de4c8115dab62747bf2a868fca792060816f361

  • SHA512

    24a2339d7a8a5a69e3faa641ef65d4dad444a0c637bdc8650120e1c0af73ef8ae002e5ea11b5e2aace495162fd72f42afb6ba843288ac5e252dcdc4af3bf6a5b

  • SSDEEP

    3072:XBBm9kHav3HbzOqVkBe82ZV4qQhA8e8hk:Xe9jTzO1eP4qQhA

Score
10/10
redlinemaxiinfostealer

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

77.91.124.145:4125

Attributes
  • auth_value

    6e90da232d4c2e35c1a36c250f5f8904

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0030000000015c1b-2186.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0030000000015c1b-2186.exe"
    1⤵
      PID:4888

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4888-0-0x00000000744C0000-0x0000000074C70000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/4888-1-0x0000000000490000-0x00000000004BE000-memory.dmp
      Filesize

      184KB

      Download
    • memory/4888-2-0x00000000028D0000-0x00000000028D6000-memory.dmp
      Filesize

      24KB

      Download
    • memory/4888-3-0x0000000005540000-0x0000000005B58000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/4888-4-0x0000000005030000-0x000000000513A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4888-5-0x0000000004F10000-0x0000000004F20000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4888-6-0x0000000004EF0000-0x0000000004F02000-memory.dmp
      Filesize

      72KB

      Download
    • memory/4888-7-0x0000000004F60000-0x0000000004F9C000-memory.dmp
      Filesize

      240KB

      Download
    • memory/4888-8-0x0000000004FB0000-0x0000000004FFC000-memory.dmp
      Filesize

      304KB

      Download
    • memory/4888-9-0x00000000744C0000-0x0000000074C70000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/4888-10-0x0000000004F10000-0x0000000004F20000-memory.dmp
      Filesize

      64KB

      Download