redline | a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238.exe
Size

170KB
MD5

2201c7c02501c312113366fe82a91cab
SHA1

5fb61fb20202cae74df85aaf39d8fa47db34db2f
SHA256

a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238
SHA512

92c6ef4bec0efbd91b63b3b51e8beb62a3648f8ae75c36edb3c3ef5ef26b2825cbb9085a82821842a178913667e83060151408cb9220fd1bec14a607d4b57f2d
SSDEEP

1536:YJAjjc5cFqlVZRGWmxgart7POlMeBp0qDQTGqVUbun6DspKJE5aSsHZYm83wYkur:8wVLmJPTqVst9+5aSsHZYmY8e8hY

Score

10^/10

redline dozt discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

dozt

77.91.124.145:4125

Attributes

auth_value
857bdfe4fa14711025859d89f18b32cb

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/876-1-0x0000000001070000-0x00000000010A0000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238.exe

C:\Users\Admin\AppData\Local\Temp\a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238.exe
"C:\Users\Admin\AppData\Local\Temp\a6d5d2aba66b4fcede1137921c9aec826e3943eaf95257ec61603b903582a238.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/876-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/876-1-0x0000000001070000-0x00000000010A0000-memory.dmp

Filesize
192KB

Download
memory/876-2-0x00000000001F0000-0x00000000001F6000-memory.dmp

Filesize
24KB

Download
memory/876-3-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download
memory/876-4-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/876-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Filesize
6.9MB

Download