redline | bc216a74104d2769435504e1ebcb968824510db1ce1a761052625bd8beb148dd

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup/AISetup-Crack.exe
Size

346.0MB
MD5

90ef61d984f55737294d927f72496891
SHA1

565881a9d1583474f6323b9fa5abb03055264965
SHA256

d0c043510a0cb5f5c3d0812f2e7f961be85f538ef7f8ed1be70c85e0cf20f3a6
SHA512

608148ee5e611bb65931f64d86fc2ae8f432dc1fa91763b3680ea5f46f44f1000d5a24e7cc7fd85737729ad64f2bb88f07e537a4d641e26220089829fccd057e
SSDEEP

49152:fe6AUzdMrocQ9CqgcnaRH5uj/VTTbeuOd86J4:fe6AedMrocQ9Cqgco5q/Vq59J

Score

10^/10

redline leo5 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

leo5

cenyeyalory.xyz:80

kaiaiannial.xyz:80

viasanainah.xyz:80

xtelstasiup.xyz:80

Attributes

auth_value
be820120fdc25e4fee4cd33b669b3e2c

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/3004-2-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/3004-8-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 3004	868	AISetup-Crack.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AISetup-Crack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32
PID 868 wrote to memory of 3004	868	AISetup-Crack.exe	32

C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe
"C:\Users\Admin\AppData\Local\Temp\setup\AISetup-Crack.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3004-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download