Analysis

  • max time kernel
    144s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 01:28

General

  • Target

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe

  • Size

    297KB

  • MD5

    0970456d2e2bcb36f49d23f5f2eec4ce

  • SHA1

    1e427bbeb209b636371d17801b14fabff87921be

  • SHA256

    264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54

  • SHA512

    43c233e6c6fb20ee5830672f68eec2a1930aff6c3da185b7af56ede90970041157755b8893a86336711c8ba8cbe3f22818de8ddc1789ed65a7aacd596771909e

  • SSDEEP

    3072:nqFFrqwIOGNTypEmz07s3WxL9z8b5bOMhd7ETZUf5IfcZqf7D34deqiOLCbBOa:qBIOGqDZOqdITZC4cZqf7DInL

Malware Config

Extracted

Family

redline

Botnet

newlogs

C2

85.28.47.7:17210

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe
    "C:\Users\Admin\AppData\Local\Temp\264db4d677606c95912a93a457675d5ebaa24dc886da8bbcb800fe831c540a54.exe"
    1⤵
      PID:2076
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,15168044379859864039,3380316340477469860,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
      1⤵
        PID:3608

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2076-0-0x000000007473E000-0x000000007473F000-memory.dmp

        Filesize

        4KB

      • memory/2076-1-0x0000000000020000-0x0000000000070000-memory.dmp

        Filesize

        320KB

      • memory/2076-2-0x0000000004F60000-0x0000000005504000-memory.dmp

        Filesize

        5.6MB

      • memory/2076-3-0x0000000004A60000-0x0000000004AF2000-memory.dmp

        Filesize

        584KB

      • memory/2076-4-0x0000000004C30000-0x0000000004C3A000-memory.dmp

        Filesize

        40KB

      • memory/2076-5-0x0000000074730000-0x0000000074EE0000-memory.dmp

        Filesize

        7.7MB

      • memory/2076-6-0x0000000005B30000-0x0000000006148000-memory.dmp

        Filesize

        6.1MB

      • memory/2076-7-0x0000000004DD0000-0x0000000004EDA000-memory.dmp

        Filesize

        1.0MB

      • memory/2076-8-0x0000000004D00000-0x0000000004D12000-memory.dmp

        Filesize

        72KB

      • memory/2076-9-0x0000000004D60000-0x0000000004D9C000-memory.dmp

        Filesize

        240KB

      • memory/2076-10-0x0000000004EE0000-0x0000000004F2C000-memory.dmp

        Filesize

        304KB

      • memory/2076-11-0x000000007473E000-0x000000007473F000-memory.dmp

        Filesize

        4KB

      • memory/2076-12-0x0000000074730000-0x0000000074EE0000-memory.dmp

        Filesize

        7.7MB