redline | 34c700463317e3ce8646c2ab1c3e97c949d4127b25953d5087ee588c29b064af

Analysis

max time kernel
141s
max time network
165s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 21:04

Target

0x00080000000122ed-116.exe
Size

145KB
MD5

a9d720bc539201de83cc4c7123899986
SHA1

2383da8e0a8593c23866c348bc51764192957104
SHA256

34c700463317e3ce8646c2ab1c3e97c949d4127b25953d5087ee588c29b064af
SHA512

371f36f07a671ebc2248c7f4116d868136dd2982b5e70d042b2b36719ad3da433bad82b2b2d852fb75d6fa39be63ea55c1a0749dd3cf3d2db826de2da3ba9962
SSDEEP

3072:5V+m5cVQmRSxIEN1MjdVti90hSZ18e8h4:5j49k90hSP

Score

10^/10

Family

redline

Botnet

larry

185.161.248.75:4132

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1720-1-0x0000000001370000-0x000000000139A000-memory.dmp	family_redline
behavioral1/memory/1720-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\0x00080000000122ed-116.exe
"C:\Users\Admin\AppData\Local\Temp\0x00080000000122ed-116.exe"
1⤵
PID:1720

memory/1720-0-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-1-0x0000000001370000-0x000000000139A000-memory.dmp

Filesize
168KB

Download
memory/1720-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1720-3-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1720-4-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download