redline | a33c889b1929e9442a2a49de188e05a8ddbddcb32a7231b7c362f6833a45d720

Analysis

max time kernel
140s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 14:40

Target

f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe
Size

490KB
MD5

a9b440ad0e7d76d9fa2ec485fa53eeba
SHA1

179dcad63a03197776e3b9ee4354dbfa413f7528
SHA256

f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616
SHA512

bbdbfdf856719da627de9c70324edfeec3e2d91d32550c12fd2923302456da68768618f45788bc68e71d48de3f30e731181b9a69139624a70bf936a8a7de3a15
SSDEEP

12288:quFz06FWD5fReUOLoFCaK40dC3l8qjNG8AR:qr+WVJeVLeK4PljJA

Score

10^/10

Family

redline

91.103.252.48:33597

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral24/memory/3604-0-0x0000000002080000-0x000000000210C000-memory.dmp	family_redline
behavioral24/memory/3604-7-0x0000000000400000-0x000000000047F000-memory.dmp	family_redline
behavioral24/memory/3604-8-0x0000000002080000-0x000000000210C000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe
"C:\Users\Admin\AppData\Local\Temp\f5d16598bff76b7aeece243b4478a48e666bbf1a2adb20f2684cefe2f7d06616.exe"
1⤵
PID:3604

memory/3604-0-0x0000000002080000-0x000000000210C000-memory.dmp

Filesize
560KB

Download
memory/3604-3-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/3604-7-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3604-8-0x0000000002080000-0x000000000210C000-memory.dmp

Filesize
560KB

Download
memory/3604-9-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/3604-10-0x0000000002660000-0x0000000002666000-memory.dmp

Filesize
24KB

Download
memory/3604-11-0x000000000A6D0000-0x000000000ACE8000-memory.dmp

Filesize
6.1MB

Download
memory/3604-12-0x000000000A0B0000-0x000000000A1BA000-memory.dmp

Filesize
1.0MB

Download
memory/3604-13-0x0000000006E20000-0x0000000006E32000-memory.dmp

Filesize
72KB

Download
memory/3604-14-0x000000000A1C0000-0x000000000A1FC000-memory.dmp

Filesize
240KB

Download
memory/3604-15-0x0000000006B70000-0x0000000006BBC000-memory.dmp

Filesize
304KB

Download