Analysis

  • max time kernel
    133s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    07-07-2024 01:45

General

  • Target

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe

  • Size

    297KB

  • MD5

    0970456d2e2bcb36f49d23f5f2eec4ce

  • SHA1

    1e427bbeb209b636371d17801b14fabff87921be

  • SHA256

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54

  • SHA512

    43c233e6c6fb20ee5830672f68eec2a1930aff6c3da185b7af56ede90970041157755b8893a86336711c8ba8cbe3f22818de8ddc1789ed65a7aacd596771909e

  • SSDEEP

    3072:nqFFrqwIOGNTypEmz07s3WxL9z8b5bOMhd7ETZUf5IfcZqf7D34deqiOLCbBOa:qBIOGqDZOqdITZC4cZqf7DInL

Malware Config

Extracted

Family

redline

Botnet

newlogs

C2

85.28.47.7:17210

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe
    "C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe"
    1⤵
      PID:2804

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2804-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

      Filesize

      4KB

    • memory/2804-1-0x00000000013E0000-0x0000000001430000-memory.dmp

      Filesize

      320KB

    • memory/2804-2-0x0000000074E70000-0x000000007555E000-memory.dmp

      Filesize

      6.9MB

    • memory/2804-3-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

      Filesize

      4KB

    • memory/2804-4-0x0000000074E70000-0x000000007555E000-memory.dmp

      Filesize

      6.9MB