redline | 5eef62986fe2c19c4e1cb41494a83ef8cb3a326b8dd548294c432ab4d8adf31e | Triage

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 09:15

Sharing

Report Analysis Logs

General

Target

0x00080000000122e1-83.exe
Size

145KB
MD5

e848e4f95209443e5f1b25508bc5f840
SHA1

587482aa0f0d520fa4638fd9b03721a3d8969b9c
SHA256

5eef62986fe2c19c4e1cb41494a83ef8cb3a326b8dd548294c432ab4d8adf31e
SHA512

a944c4505b8f368d3cdfe557fdf4ce0f7c42a7c802927722d4aa29565d2d879e6924c620d22fcad47fedc95e2abe51722851146e1a3fe5f0c62bda4e1d763642
SSDEEP

3072:6V+m5cDQmRSgEZtDMucQTzIXNnpjKhUZp8e8hQ:6j6M7csYNnFKhUz

Score

10^/10

redline maxi infostealer

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19062

Attributes

auth_value
6a3f22e5f4209b056a3fd330dc71956a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2836-0-0x0000000000F40000-0x0000000000F6A000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\0x00080000000122e1-83.exe
"C:\Users\Admin\AppData\Local\Temp\0x00080000000122e1-83.exe"
1⤵
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x0000000000F40000-0x0000000000F6A000-memory.dmp

Filesize
168KB

Download
memory/2836-1-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download
memory/2836-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2836-3-0x0000000074700000-0x0000000074DEE000-memory.dmp

Filesize
6.9MB

Download