redline | 3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf

Analysis

max time kernel
131s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/11/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf.exe
Size

175KB
MD5

ceb7b1d7ca7adf4eb8b3ea66b4b5db88
SHA1

1554e88c063a3c62b9f4052384e09ec27bcc2004
SHA256

3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf
SHA512

21c4a496a464f778cbdb16f981dbe593d5f8086360bc8f99757c9dba9504679b75e92fe1054393d50249e1e5fd163b15c84e2783b493d83b766fd0f45188193d
SSDEEP

3072:BxqZW11a2kX8fkRyeiBWep3FhhFvxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOf:zqZkkgN1hh

Score

10^/10

redline fabio discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

fabio

193.233.20.27:4123

Attributes

auth_value
56b82736c3f56b13be8e64c87d2cf9e5

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2092-1-0x00000000000B0000-0x00000000000E2000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf.exe

C:\Users\Admin\AppData\Local\Temp\3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf.exe
"C:\Users\Admin\AppData\Local\Temp\3edc512aadef1c0269871c08c643729dbc606e605958f86b696fcd5233154edf.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x00000000000B0000-0x00000000000E2000-memory.dmp

Filesize
200KB

Download
memory/2092-2-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-3-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2092-4-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download