Analysis Overview
SHA256
fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e
Threat Level: Known bad
The file fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e was found to be: Known bad.
Malicious Activity Summary
RedLine
Redline family
System Location Discovery: System Language Discovery
Unsigned PE
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 13:21
Signatures
Redline family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-10 13:21
Reported
2024-11-10 13:24
Platform
win10v2004-20241007-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
RedLine
Redline family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe
"C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.117.19.2.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp |
Files
memory/3280-0-0x0000000074A0E000-0x0000000074A0F000-memory.dmp
memory/3280-1-0x0000000000980000-0x00000000009DA000-memory.dmp
memory/3280-2-0x0000000002C90000-0x0000000002C96000-memory.dmp
memory/3280-3-0x0000000074A00000-0x00000000751B0000-memory.dmp
memory/3280-4-0x0000000005AC0000-0x00000000060D8000-memory.dmp
memory/3280-5-0x00000000055B0000-0x00000000056BA000-memory.dmp
memory/3280-6-0x00000000054E0000-0x00000000054F2000-memory.dmp
memory/3280-7-0x0000000005540000-0x000000000557C000-memory.dmp
memory/3280-8-0x00000000056C0000-0x000000000570C000-memory.dmp
memory/3280-9-0x0000000074A0E000-0x0000000074A0F000-memory.dmp
memory/3280-10-0x0000000074A00000-0x00000000751B0000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 13:21
Reported
2024-11-10 13:24
Platform
win7-20240903-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
RedLine
Redline family
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe
"C:\Users\Admin\AppData\Local\Temp\fbcb6b5aca0c10cacf9d99665cd5db817dc10fab8f5f07546202306d30b1eb8e.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp | |
| RU | 37.220.86.164:29170 | tcp |
Files
memory/2072-0-0x000000007491E000-0x000000007491F000-memory.dmp
memory/2072-1-0x0000000000D80000-0x0000000000DDA000-memory.dmp
memory/2072-2-0x00000000004C0000-0x00000000004C6000-memory.dmp
memory/2072-3-0x0000000074910000-0x0000000074FFE000-memory.dmp
memory/2072-4-0x000000007491E000-0x000000007491F000-memory.dmp
memory/2072-5-0x0000000074910000-0x0000000074FFE000-memory.dmp