redline | 7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 01:32

Target

7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92.exe
Size

411KB
MD5

1b898df684811054d405e9c31fddd80a
SHA1

9a322fd8e07427ce716f0dd9210ff563091e32de
SHA256

7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92
SHA512

c154faa686a30957718af46ab2150b1241d783025505b53adac9667af7e9d45ed4f08f22ffc6c45d0c9c47f070f427c5467600839aa94a3718719b7ec80e9be5
SSDEEP

6144:ir2uImjz71CmoNwemgkFfsQzGtvSiFsbHTYTS2wvp8GIUnl2:+Wmf7poNweTkFkQzkvSrDWS2wvp8enk

Score

10^/10

Family

redline

141.94.188.138:46419

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1900-2-0x0000000004D70000-0x0000000004D92000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1900-2-0x0000000004D70000-0x0000000004D92000-memory.dmp	family_sectoprat

C:\Users\Admin\AppData\Local\Temp\7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92.exe
"C:\Users\Admin\AppData\Local\Temp\7386925178799b6b5a78e550ab756eedb61bb62adc8db66623f4a60dff30fe92.exe"
1⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3856,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
1⤵
PID:1316

memory/1900-0-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

Filesize
4KB

Download
memory/1900-1-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1900-2-0x0000000004D70000-0x0000000004D92000-memory.dmp

Filesize
136KB

Download
memory/1900-3-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/1900-4-0x00000000054F0000-0x0000000005B08000-memory.dmp

Filesize
6.1MB

Download
memory/1900-5-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/1900-6-0x0000000004FE0000-0x00000000050EA000-memory.dmp

Filesize
1.0MB

Download
memory/1900-7-0x0000000004ED0000-0x0000000004F0C000-memory.dmp

Filesize
240KB

Download
memory/1900-8-0x0000000004F10000-0x0000000004F5C000-memory.dmp

Filesize
304KB

Download
memory/1900-9-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

Filesize
4KB

Download
memory/1900-10-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download