redline | 278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe.exe
Size

175KB
MD5

1132b99d2ccaab6591647b904f34680c
SHA1

85e84620a6e04dc2fc0db5b23c03ab848f3922b8
SHA256

278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe
SHA512

9cf19de714c88462291db3e4ae1c631115439bccf58d2937105c218da17a4e6061563f22c4207ab2fb58c0e133e4af7b673292939c178b0c7a5c3c7471b7a11e
SSDEEP

3072:RxqZWDdxafU74XRVuNsceB/FrhavxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOU:DqZcIRVuWHrhD

Score

10^/10

redline fchan discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

fchan

pepunn.com:4162

Attributes

auth_value
127bd53d55e8c4f0dd2f6e1ea60deef4

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2324-1-0x0000000000810000-0x0000000000842000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe.exe

C:\Users\Admin\AppData\Local\Temp\278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe.exe
"C:\Users\Admin\AppData\Local\Temp\278e494567f8e9bf557b2321629a867b6562e9771d70df5ac0139e8a1e70defe.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2324-1-0x0000000000810000-0x0000000000842000-memory.dmp

Filesize
200KB

Download
memory/2324-2-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2324-3-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2324-4-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download