redline | c5a3dbeea17ddba50482e7844a817171580f977dcea9ad7b655d39a934b93b93

Submit
Reports

Overview

overview

Static

static

1d059ca891...d4.exe

windows10-2004-x64

1d90edda9f...51.exe

windows7-x64

1d90edda9f...51.exe

windows10-2004-x64

1e44c41d8d...91.exe

windows10-2004-x64

1ed736973c...3e.exe

windows10-2004-x64

559234fc52...e2.exe

windows10-2004-x64

5a4570005d...a4.exe

windows7-x64

5a4570005d...a4.exe

windows10-2004-x64

61f1a776dc...62.exe

windows10-2004-x64

67045db960...01.exe

windows10-2004-x64

6d684b37ca...5c.exe

windows10-2004-x64

77cbabe9fe...cf.exe

windows7-x64

77cbabe9fe...cf.exe

windows10-2004-x64

8a73bb4899...c3.exe

windows10-2004-x64

8db3c27c31...88.exe

windows7-x64

8db3c27c31...88.exe

windows10-2004-x64

b72cfb2517...df.exe

windows10-2004-x64

c2ef692d84...7e.exe

windows7-x64

c2ef692d84...7e.exe

windows10-2004-x64

c39106a352...4e.exe

windows7-x64

c39106a352...4e.exe

windows10-2004-x64

ca6d56a637...da.exe

windows10-2004-x64

db14966ca7...cb.exe

windows7-x64

db14966ca7...cb.exe

windows10-2004-x64

e800205bb9...fd.exe

windows7-x64

e800205bb9...fd.exe

windows10-2004-x64

f8a2da44f9...41.exe

windows10-2004-x64

fc8b501a18...d3.exe

windows7-x64

fc8b501a18...d3.exe

windows10-2004-x64

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 12:29

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1d059ca891566e0006cb4534dc4ff845fedd1d3d468c12366e12f98a815ed7d4.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral4

Sample

1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691.exe

Resource

win10v2004-20240508-en

amadey healer redline krast dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral5

Sample

1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e.exe

Resource

win10v2004-20240426-en

amadey healer redline smokeloader roma backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral6

Sample

559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2.exe

Resource

win10v2004-20240426-en

amadey healer redline lande dropper evasion infostealer persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral7

Sample

5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

5a4570005d13d7c9c706dbdc0cc5ee5b8dfd33f7be6a6204a95d2134e3a483a4.exe

Resource

win10v2004-20240508-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral9

Sample

61f1a776dcd13885a5979397d5b945e89d26cfcfe61e000ac89070e4a45bc562.exe

Resource

win10v2004-20240508-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral10

Sample

67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501.exe

Resource

win10v2004-20240508-en

healer redline lamp dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral11

Sample

6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c.exe

Resource

win10v2004-20240426-en

amadey healer smokeloader backdoor dropper evasion persistence trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral12

Sample

77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf.exe

Resource

win10v2004-20240226-en

lumma stealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral14

Sample

8a73bb4899be69e1a77d74c46f81ca29b85b5c67b642e09f9735dec87b8b4cc3.exe

Resource

win10v2004-20240426-en

healer redline dumud dropper evasion infostealer persistence trojan

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral15

Sample

8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

8db3c27c31541a43d1adeae01ca7caf3f0c8d6e3733168917ea04d58d7e4a488.exe

Resource

win10v2004-20240426-en

redline 7001210066 discovery infostealer

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral17

Sample

b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf.exe

Resource

win10v2004-20240508-en

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral18

Sample

c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

c2ef692d84f694cd08e3238ae431c5636be2dc51342782c20a577eb05217557e.exe

Resource

win10v2004-20240508-en

redline zgrat discovery infostealer rat spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral20

Sample

c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe

Resource

win7-20240508-en

healer dropper evasion trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral21

Sample

c39106a3520b59f859a00bc0014f6b5a4846b40742a925b66283b31e62094c4e.exe

Resource

win10v2004-20240426-en

healer dropper evasion trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral22

Sample

ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da.exe

Resource

win10v2004-20240426-en

healer redline lamp dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral23

Sample

db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe

Resource

win7-20231129-en

redline lux3 infostealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral24

Sample

db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe

Resource

win10v2004-20240508-en

redline lux3 infostealer

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral25

Sample

e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral26

Sample

e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd.exe

Resource

win10v2004-20240508-en

redline 5195552529 discovery infostealer spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral27

Sample

f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41.exe

Resource

win10v2004-20240508-en

amadey healer redline smokeloader lande backdoor dropper evasion infostealer persistence trojan

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral28

Sample

fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3.exe

Resource

win10v2004-20240426-en

lumma stealer

windows10-2004-x64

4 signatures

150 seconds

Report Analysis Logs

General

Target

db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
Size

274KB
MD5

17c694e79f6d36c7ddf2d0826847af9c
SHA1

4a9ede0f5efe78a4807230fa8dc0ae4d9e6fd9e8
SHA256

db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb
SHA512

bfe84a7d6a038df984e6d789c0169771a567488137d01b8df27b67706aca915fddb14d510dc9c654281b25a2e65cf5c57d009b16cd78a0170ee13dd70e12b363
SSDEEP

6144:SJhy0g57Kx1lgD0568wQ7tuMp2tHnAm9CMtM:SJhcx0568wbt

Score

10^/10

redline lux3 infostealer

Malware Config

Extracted

Family

redline

Botnet

lux3

176.123.9.142:14845

Attributes

auth_value
e94dff9a76da90d6b000642c4a52574b

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral23/memory/2188-1-0x0000000000450000-0x0000000000480000-memory.dmp	family_redline
behavioral23/memory/2188-5-0x0000000000400000-0x0000000000446000-memory.dmp	family_redline

Processes

C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe
"C:\Users\Admin\AppData\Local\Temp\db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb.exe"
1⤵
PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-1-0x0000000000450000-0x0000000000480000-memory.dmp

Filesize
192KB

Download
memory/2188-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2188-5-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2188-6-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download