redline | 80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73.exe
Size

170KB
MD5

1ccf0b7a62f796b9da7c73bf22840b34
SHA1

4992e941a081712803d6554b86cddf08a9dc6959
SHA256

80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73
SHA512

e1bf02c7e72fd8929eec5058c2157070ca187eec4f170a5a636abf331fa735caa056621f04e8141beaf23bcbb5d3d90d06a164f8589bf2144eabbfdaa611ea59
SSDEEP

1536:YJAjjc5cFqlVZRGWmxgart7POlMeBp0qDQTGqVUbun6DspKJE5aSsHZYm83wYkur:8wVLmJPTqVst9+5aSsHZYmY8e8hY

Score

10^/10

redline dozt discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

dozt

77.91.124.145:4125

Attributes

auth_value
857bdfe4fa14711025859d89f18b32cb

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1308-1-0x00000000009E0000-0x0000000000A10000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73.exe

C:\Users\Admin\AppData\Local\Temp\80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73.exe
"C:\Users\Admin\AppData\Local\Temp\80cbf897349a9953840e0533d8b107c0be45d1a13d382c2c5567258a66977c73.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-0-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/1308-1-0x00000000009E0000-0x0000000000A10000-memory.dmp

Filesize
192KB

Download
memory/1308-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1308-3-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/1308-4-0x000000007444E000-0x000000007444F000-memory.dmp

Filesize
4KB

Download
memory/1308-5-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download