Analysis

  • max time kernel
    144s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/07/2024, 21:29

General

  • Target

    build.exe

  • Size

    300KB

  • MD5

    c9ab1bd80ddd71d596a3c787ce5b9c0b

  • SHA1

    91befc62dd138febb1966b7bf0665a7c128067e6

  • SHA256

    66d4116aff564bd6f75c8c7c663a4ae4f69d42189cd2a824e8c55b3f2bcf6dd3

  • SHA512

    d783f6742feb1ba75758047985acf215f4c05b0a99afddfd9ab0b89188a54c04129a88dc5dde44e4a2ff735956252553018ff76e1ee145fca3f2258ffd057db7

  • SSDEEP

    3072:ecZqf7D34wp/0+mAKky4iSQIgl+B1fA0PuTVAtkxz+3RweqiOL2bBOA:ecZqf7DIAnSR8B1fA0GTV8kYQL

Malware Config

Extracted

Family

redline

Botnet

Random

C2

times-ripe.gl.at.ply.gg:23923

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
      PID:2084

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2084-0-0x000000007370E000-0x000000007370F000-memory.dmp

            Filesize

            4KB

          • memory/2084-1-0x0000000000E50000-0x0000000000EA2000-memory.dmp

            Filesize

            328KB

          • memory/2084-2-0x0000000005B60000-0x000000000605E000-memory.dmp

            Filesize

            5.0MB

          • memory/2084-3-0x0000000005740000-0x00000000057D2000-memory.dmp

            Filesize

            584KB

          • memory/2084-4-0x0000000005710000-0x000000000571A000-memory.dmp

            Filesize

            40KB

          • memory/2084-5-0x0000000073700000-0x0000000073DEE000-memory.dmp

            Filesize

            6.9MB

          • memory/2084-6-0x0000000006670000-0x0000000006C76000-memory.dmp

            Filesize

            6.0MB

          • memory/2084-7-0x0000000006170000-0x000000000627A000-memory.dmp

            Filesize

            1.0MB

          • memory/2084-8-0x0000000005AB0000-0x0000000005AC2000-memory.dmp

            Filesize

            72KB

          • memory/2084-9-0x0000000005B10000-0x0000000005B4E000-memory.dmp

            Filesize

            248KB

          • memory/2084-10-0x0000000006060000-0x00000000060AB000-memory.dmp

            Filesize

            300KB

          • memory/2084-11-0x000000007370E000-0x000000007370F000-memory.dmp

            Filesize

            4KB

          • memory/2084-12-0x0000000073700000-0x0000000073DEE000-memory.dmp

            Filesize

            6.9MB