Resubmissions

20-05-2024 13:36

240520-qv95eacd59 10

Analysis

  • max time kernel
    4s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 13:36

General

  • Target

    RedlineBuilder.exe

  • Size

    308KB

  • MD5

    128cbb0f113189a8af347f14cb223357

  • SHA1

    7472ff8bcf4b6ab90e30ec0352f0ecb44c655cf7

  • SHA256

    a392dc6ad27dbc999aef5db8efaa63a65e570ca3bff7a79c5053ce7b7ba41a0e

  • SHA512

    1bddf607e1e8ef32d39e16fcb9d9d87573f61ceee9a898c287ad236beaea818b223a28196395145a7b3eca5883e5da5b3a3dc0273fd66d64e103c24739868b35

  • SSDEEP

    3072:+gccZqf7D34up/0+mAxkynW2Qlg7g6B1fA0PuTVAtkxzr3RceqiOL2bBOAK:AcZqf7DIWnGN8B1fA0GTV8khkL

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RedlineBuilder.exe
    "C:\Users\Admin\AppData\Local\Temp\RedlineBuilder.exe"
    1⤵
      PID:2664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 872
        2⤵
        • Program crash
        PID:2224
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 2664
      1⤵
        PID:2040

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2664-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

        Filesize

        4KB

      • memory/2664-1-0x0000000000CE0000-0x0000000000D34000-memory.dmp

        Filesize

        336KB