Analysis

  • max time kernel
    141s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 01:45

General

  • Target

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe

  • Size

    297KB

  • MD5

    0970456d2e2bcb36f49d23f5f2eec4ce

  • SHA1

    1e427bbeb209b636371d17801b14fabff87921be

  • SHA256

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54

  • SHA512

    43c233e6c6fb20ee5830672f68eec2a1930aff6c3da185b7af56ede90970041157755b8893a86336711c8ba8cbe3f22818de8ddc1789ed65a7aacd596771909e

  • SSDEEP

    3072:nqFFrqwIOGNTypEmz07s3WxL9z8b5bOMhd7ETZUf5IfcZqf7D34deqiOLCbBOa:qBIOGqDZOqdITZC4cZqf7DInL

Malware Config

Extracted

Family

redline

Botnet

newlogs

C2

85.28.47.7:17210

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe
    "C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe"
    1⤵
      PID:1660

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1660-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

      Filesize

      4KB

    • memory/1660-1-0x0000000000BD0000-0x0000000000C20000-memory.dmp

      Filesize

      320KB

    • memory/1660-2-0x0000000005CD0000-0x0000000006274000-memory.dmp

      Filesize

      5.6MB

    • memory/1660-3-0x0000000005600000-0x0000000005692000-memory.dmp

      Filesize

      584KB

    • memory/1660-4-0x00000000056C0000-0x00000000056CA000-memory.dmp

      Filesize

      40KB

    • memory/1660-5-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1660-6-0x00000000068A0000-0x0000000006EB8000-memory.dmp

      Filesize

      6.1MB

    • memory/1660-7-0x0000000005AC0000-0x0000000005BCA000-memory.dmp

      Filesize

      1.0MB

    • memory/1660-8-0x00000000057A0000-0x00000000057B2000-memory.dmp

      Filesize

      72KB

    • memory/1660-9-0x0000000005900000-0x000000000593C000-memory.dmp

      Filesize

      240KB

    • memory/1660-10-0x0000000005950000-0x000000000599C000-memory.dmp

      Filesize

      304KB

    • memory/1660-11-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

      Filesize

      4KB

    • memory/1660-12-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB