Analysis
-
max time kernel
134s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-05-2024 15:13
General
-
Target
cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe
-
Size
491KB
-
MD5
dd10174f7fa3d017558c8310bf07d851
-
SHA1
08d795a3d2334906da989e46a7e57d4ba9aa9f41
-
SHA256
cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604
-
SHA512
a714e8babdc8d8a0a9f8e6ef6430d4f1cde70d3d80a902a1e247eb93bdf76e91fa89c4132708e0c632469b725c625ae65e30a908f02018f10b23460a02ec9d05
-
SSDEEP
6144:byblvlO3FlxJyFVsxRc4jdcE2rnfUT2pMBUdwrKkUfzK4V19X8GnYkCDWFElr:bOlvlGIsThKrnfnMBBSzK4VwGYF6FYr
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
lamp
C2
77.91.68.56:19071
Attributes
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe"C:\Users\Admin\AppData\Local\Temp\cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1548-0-0x0000000000480000-0x000000000050C000-memory.dmpFilesize
560KB
-
memory/1548-6-0x0000000000401000-0x0000000000404000-memory.dmpFilesize
12KB
-
memory/1548-7-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1548-9-0x0000000006A50000-0x0000000006A51000-memory.dmpFilesize
4KB
-
memory/1548-8-0x0000000000480000-0x000000000050C000-memory.dmpFilesize
560KB
-
memory/1548-10-0x00000000040B0000-0x00000000040B6000-memory.dmpFilesize
24KB