Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/07/2024, 21:29

General

  • Target

    build.exe

  • Size

    300KB

  • MD5

    c9ab1bd80ddd71d596a3c787ce5b9c0b

  • SHA1

    91befc62dd138febb1966b7bf0665a7c128067e6

  • SHA256

    66d4116aff564bd6f75c8c7c663a4ae4f69d42189cd2a824e8c55b3f2bcf6dd3

  • SHA512

    d783f6742feb1ba75758047985acf215f4c05b0a99afddfd9ab0b89188a54c04129a88dc5dde44e4a2ff735956252553018ff76e1ee145fca3f2258ffd057db7

  • SSDEEP

    3072:ecZqf7D34wp/0+mAKky4iSQIgl+B1fA0PuTVAtkxz+3RweqiOL2bBOA:ecZqf7DIAnSR8B1fA0GTV8kYQL

Malware Config

Extracted

Family

redline

Botnet

Random

C2

times-ripe.gl.at.ply.gg:23923

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    1⤵
      PID:3956

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3956-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

            Filesize

            4KB

          • memory/3956-1-0x0000000000F20000-0x0000000000F72000-memory.dmp

            Filesize

            328KB

          • memory/3956-2-0x0000000006090000-0x0000000006636000-memory.dmp

            Filesize

            5.6MB

          • memory/3956-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp

            Filesize

            584KB

          • memory/3956-4-0x0000000005AE0000-0x0000000005AEA000-memory.dmp

            Filesize

            40KB

          • memory/3956-5-0x0000000074E60000-0x0000000075611000-memory.dmp

            Filesize

            7.7MB

          • memory/3956-6-0x0000000006C60000-0x0000000007278000-memory.dmp

            Filesize

            6.1MB

          • memory/3956-7-0x0000000005DD0000-0x0000000005EDA000-memory.dmp

            Filesize

            1.0MB

          • memory/3956-8-0x0000000005CC0000-0x0000000005CD2000-memory.dmp

            Filesize

            72KB

          • memory/3956-9-0x0000000005D20000-0x0000000005D5C000-memory.dmp

            Filesize

            240KB

          • memory/3956-10-0x0000000005D70000-0x0000000005DBC000-memory.dmp

            Filesize

            304KB

          • memory/3956-11-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

            Filesize

            4KB

          • memory/3956-12-0x0000000074E60000-0x0000000075611000-memory.dmp

            Filesize

            7.7MB