redline | 80ed3454e9a44debe81d41682d26a343ed19f8d7f8706bad7805e2e8a26f657d

Resubmissions

11/11/2024, 21:13

241111-z2y56azmcn 10

30/07/2022, 13:41

220730-qzlydabdd7 10

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/11/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Warzone hack space cheats/Warzone hack.exe
Size

2.5MB
MD5

3f4540b7b375b6f612c2256998af7c3c
SHA1

59d101e0020dcd567c2d0ecc271a0067122caff4
SHA256

e6cdd59f34d4bf7707237f377a4b58e1c4060f190068241c406b4c36719d8926
SHA512

ef06c781c8fe20b64b3ab7048dee8f84f7bbbfefcf2d91be1eb0206969c01962633c439d4c3929052c6a9c53b834997189f3017c4affc0079f44b29130f0c2d7
SSDEEP

24576:F1J/o3viYPYCQllGmmMbOdLDnay9ObwmePSGcWmLhgOL3xGhl3RuQ55313/:F1y3fv+McWmLhgOMl3h

Score

10^/10

redline discovery infostealer

Malware Config

Extracted

Family

redline

193.106.191.160:8673

Attributes

auth_value
4334b1b6304e7a30dd9472e85aa443c9

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral5/memory/193500-10-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral5/memory/193500-9-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral5/memory/193500-3-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Redline family
redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 193500	1456	Warzone hack.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone hack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30
PID 1456 wrote to memory of 193500	1456	Warzone hack.exe	30

C:\Users\Admin\AppData\Local\Temp\Warzone hack space cheats\Warzone hack.exe
"C:\Users\Admin\AppData\Local\Temp\Warzone hack space cheats\Warzone hack.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:193500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-0-0x00000000004B9000-0x00000000004BA000-memory.dmp

Filesize
4KB

Download
memory/1456-11-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/193500-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/193500-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/193500-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/193500-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/193500-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/193500-12-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/193500-13-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download