redline | f66854431dc57070e060e776be18cba0992366fab22b71f8cf929b91c81a6c26

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 14:27

Target

5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe
Size

278KB
MD5

380a33366b16a0894082c78984ba8345
SHA1

9ae5f79b7bdc0d1a1141c5a9d318fe8680149e14
SHA256

5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37
SHA512

81cd5aaec512b832e69f071c62339578b1c8ec5170962887899f5164ff3c236275e71c63708c1083872c536b8e80ca5057c3f011b556994993c72faf6bb0cac6
SSDEEP

6144:oA4BeDwJ7SRiJVN2FdyxSDQdMP5cIieWIJQjTWuo:oA+z2Xyx7TA

Score

10^/10

Family

redline

Botnet

@WinBinLow

45.9.74.149:48852

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral12/memory/2228-0-0x0000000000220000-0x0000000000250000-memory.dmp	family_redline
behavioral12/memory/2228-5-0x0000000000400000-0x0000000000447000-memory.dmp	family_redline

C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe
"C:\Users\Admin\AppData\Local\Temp\5460a1d2c84823a33909daab1fdc811ef8902f88377e1cf46112a9d0cdce6e37.exe"
1⤵
PID:2228

memory/2228-0-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2228-4-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2228-5-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2228-6-0x0000000002040000-0x0000000002046000-memory.dmp

Filesize
24KB

Download