Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:13
Behavioral task
behavioral1
Sample
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe
Resource
win10v2004-20241007-en
General
-
Target
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe
-
Size
128KB
-
MD5
eb9ff5335b70ec1fc97d9d1d5778b7fb
-
SHA1
b9abbb5fe37c328dc43f4b03ac9041a9e8766030
-
SHA256
e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85
-
SHA512
45dbb976e5e6d062ea9e24a7cf52f80e5f5add010a3240ae264bda37b92c8f3dfe509e37e565cc1d523682abccc401bb68db16e93d940324ae372f4eb56feda9
-
SSDEEP
1536:k002k+aQD9B9R60PGkHvPXm8w4jZSe4XxoC/hzKvibYNfcovR+8Lp:krQDz+wm8w4jZcXxoWGevqV
Malware Config
Extracted
redline
45.9.20.167:34189
-
auth_value
8cd9071c1cde5086bf9e52c4a65e22e0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/1508-0-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e645a5a84d1a16914119f704e7bf71c44336821a1dc306d5c89d037f7c1aec85.exe