Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:23
Behavioral task
behavioral1
Sample
a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b.exe
Resource
win10v2004-20240508-en
General
-
Target
a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b.exe
-
Size
106KB
-
MD5
757d53805846243e6e7e67d8ec6d0950
-
SHA1
cca21bba69b60085fa0b1d59b4696c1d53f61308
-
SHA256
a55ac1675024fe2364102cd1410ec105b443d0c866d68ee7cf3a5ba060d90e5b
-
SHA512
4a33001fc9ee00fcedb477a3dd3d6249392b9878ff12d263bac9602f3ad62576842f138e1b1d8e376a08c55ebb18f3b98c8d6ac7bc3bdcd4f3a05fd9c6f23e18
-
SSDEEP
1536:FOpG0Ad02HDgzfdqKbN1gYg6mxcis2bZDKAn0jBobx4J9C00Ien:FOpLA9HDAfdByYg6mxHvDSOsIio
Malware Config
Extracted
redline
1612
95.217.35.153:9678
-
auth_value
b5a5176fed2f09773f56b63ef46db825
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3872-1-0x0000000000540000-0x0000000000560000-memory.dmp family_redline
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3872-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmpFilesize
4KB
-
memory/3872-1-0x0000000000540000-0x0000000000560000-memory.dmpFilesize
128KB
-
memory/3872-2-0x00000000054D0000-0x0000000005AE8000-memory.dmpFilesize
6.1MB
-
memory/3872-3-0x0000000004F00000-0x0000000004F12000-memory.dmpFilesize
72KB
-
memory/3872-4-0x0000000005030000-0x000000000513A000-memory.dmpFilesize
1.0MB
-
memory/3872-5-0x0000000004F90000-0x0000000004FCC000-memory.dmpFilesize
240KB
-
memory/3872-6-0x0000000074AC0000-0x0000000075270000-memory.dmpFilesize
7.7MB
-
memory/3872-7-0x0000000004FD0000-0x000000000501C000-memory.dmpFilesize
304KB
-
memory/3872-8-0x0000000074ACE000-0x0000000074ACF000-memory.dmpFilesize
4KB
-
memory/3872-9-0x0000000074AC0000-0x0000000075270000-memory.dmpFilesize
7.7MB