redline | 846a40205eab9eb9a7b40ed94a96e90b80655436b0208a925f133a7dd78b7536

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 05:52

Target

0x000600000002314b-2127.exe
Size

176KB
MD5

3e40aeb98b3adc8f32c4680898a612d0
SHA1

ceaec19a972ffcb9d8390748bd20b839def6a8fa
SHA256

846a40205eab9eb9a7b40ed94a96e90b80655436b0208a925f133a7dd78b7536
SHA512

48ab77b0289fe73ca5d2b1b3e50511bc3a6712e7d72ade14a9698ff0e7de8fdd5b076c6c74280afb5f5ade4af6900b1a8a61cf7e82ec14c66590b1a08cfb3d08
SSDEEP

3072:pxqZWzvagwoMR3I58ZlHeR5FthXfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOb:bqZVY8qth

Score

10^/10

Family

redline

Botnet

spora

176.113.115.145:4125

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2904-0-0x0000000000390000-0x00000000003C2000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\0x000600000002314b-2127.exe
"C:\Users\Admin\AppData\Local\Temp\0x000600000002314b-2127.exe"
1⤵
PID:2904

memory/2904-0-0x0000000000390000-0x00000000003C2000-memory.dmp

Filesize
200KB

Download
memory/2904-1-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-2-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download
memory/2904-3-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-4-0x00000000051B0000-0x00000000051F0000-memory.dmp

Filesize
256KB

Download