Analysis Overview
SHA256
ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989
Threat Level: Known bad
The file ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989 was found to be: Known bad.
Malicious Activity Summary
RedLine
Redline family
Unsigned PE
System Location Discovery: System Language Discovery
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-08 00:42
Signatures
Redline family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-08 00:42
Reported
2024-11-08 00:45
Platform
win10v2004-20241007-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
RedLine
Redline family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe
"C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 99.208.201.84.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp |
Files
memory/4960-0-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/4960-1-0x0000000000170000-0x00000000001CA000-memory.dmp
memory/4960-2-0x0000000004AF0000-0x0000000004AF6000-memory.dmp
memory/4960-3-0x00000000744D0000-0x0000000074C80000-memory.dmp
memory/4960-4-0x000000000A860000-0x000000000AE78000-memory.dmp
memory/4960-5-0x000000000A3C0000-0x000000000A4CA000-memory.dmp
memory/4960-6-0x000000000A2F0000-0x000000000A302000-memory.dmp
memory/4960-7-0x000000000A350000-0x000000000A38C000-memory.dmp
memory/4960-8-0x00000000045E0000-0x000000000462C000-memory.dmp
memory/4960-9-0x00000000744DE000-0x00000000744DF000-memory.dmp
memory/4960-10-0x00000000744D0000-0x0000000074C80000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-08 00:42
Reported
2024-11-08 00:45
Platform
win7-20241010-en
Max time kernel
148s
Max time network
154s
Command Line
Signatures
RedLine
Redline family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe
"C:\Users\Admin\AppData\Local\Temp\ca830f6d88da488a0bcb6b40ec4f9d5df5cbe17224cae4374c685f9da2997989.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp |
Files
memory/2104-0-0x00000000749AE000-0x00000000749AF000-memory.dmp
memory/2104-1-0x00000000011A0000-0x00000000011FA000-memory.dmp
memory/2104-2-0x00000000001F0000-0x00000000001F6000-memory.dmp
memory/2104-3-0x00000000749A0000-0x000000007508E000-memory.dmp
memory/2104-4-0x00000000749AE000-0x00000000749AF000-memory.dmp
memory/2104-5-0x00000000749A0000-0x000000007508E000-memory.dmp