redline | 2be195bb4ca21b794287f8430be7cc6166b292bd0062f5ae4d4e5083cf8b3389

Analysis

max time kernel
107s
max time network
123s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ea7431b45e2c3bf36cf33728fd245b6077a869a01500849d8d6b5d6a337fdb0N.exe
Size

168KB
MD5

e8b3242a59e85a469202a6789c84ab37
SHA1

28dd599eddcce2a30291d4e61f8565bb5c108fba
SHA256

2be195bb4ca21b794287f8430be7cc6166b292bd0062f5ae4d4e5083cf8b3389
SHA512

a5dd3b243cf9526da85d0661da9d60d38b5ac769c9bc2a7c566a2a0e0d464212e22d6a94bccb780fd4ad1c132593bf30f885b217ebdc186430f028069b9e6718
SSDEEP

1536:ZMtBxUqlVZRGWW3pasr8x8DWGPvyJqFaR8RTGqVabuZqp5F2uPB83wYkp8e8hdX:+tbk3Uxel6JPRjqVOs2X2uPBH8e8hdX

Score

10^/10

redline dark discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

dark

185.161.248.73:4164

Attributes

auth_value
ae85b01f66afe8770afeed560513fc2d

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1492-1-0x0000000000930000-0x0000000000960000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ea7431b45e2c3bf36cf33728fd245b6077a869a01500849d8d6b5d6a337fdb0N.exe

C:\Users\Admin\AppData\Local\Temp\6ea7431b45e2c3bf36cf33728fd245b6077a869a01500849d8d6b5d6a337fdb0N.exe
"C:\Users\Admin\AppData\Local\Temp\6ea7431b45e2c3bf36cf33728fd245b6077a869a01500849d8d6b5d6a337fdb0N.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1492-1-0x0000000000930000-0x0000000000960000-memory.dmp

Filesize
192KB

Download
memory/1492-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1492-3-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-4-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/1492-5-0x0000000074970000-0x000000007505E000-memory.dmp

Filesize
6.9MB

Download