Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
10-05-2024 15:13
General
-
Target
cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe
-
Size
491KB
-
MD5
dd10174f7fa3d017558c8310bf07d851
-
SHA1
08d795a3d2334906da989e46a7e57d4ba9aa9f41
-
SHA256
cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604
-
SHA512
a714e8babdc8d8a0a9f8e6ef6430d4f1cde70d3d80a902a1e247eb93bdf76e91fa89c4132708e0c632469b725c625ae65e30a908f02018f10b23460a02ec9d05
-
SSDEEP
6144:byblvlO3FlxJyFVsxRc4jdcE2rnfUT2pMBUdwrKkUfzK4V19X8GnYkCDWFElr:bOlvlGIsThKrnfnMBBSzK4VwGYF6FYr
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
lamp
C2
77.91.68.56:19071
Attributes
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe"C:\Users\Admin\AppData\Local\Temp\cd9de412cda28c677351594338bc352dbcafb8652328624f624263b71bac3604.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4344-0-0x0000000000401000-0x0000000000404000-memory.dmpFilesize
12KB
-
memory/4344-1-0x0000000000610000-0x000000000069C000-memory.dmpFilesize
560KB
-
memory/4344-7-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4344-9-0x0000000004530000-0x0000000004531000-memory.dmpFilesize
4KB
-
memory/4344-8-0x0000000000610000-0x000000000069C000-memory.dmpFilesize
560KB
-
memory/4344-10-0x0000000004540000-0x0000000004546000-memory.dmpFilesize
24KB
-
memory/4344-11-0x00000000049F0000-0x0000000005008000-memory.dmpFilesize
6.1MB
-
memory/4344-12-0x00000000050A0000-0x00000000051AA000-memory.dmpFilesize
1.0MB
-
memory/4344-13-0x00000000051D0000-0x00000000051E2000-memory.dmpFilesize
72KB
-
memory/4344-14-0x00000000051F0000-0x000000000522C000-memory.dmpFilesize
240KB
-
memory/4344-15-0x0000000005260000-0x00000000052AC000-memory.dmpFilesize
304KB