Analysis
-
max time kernel
136s -
max time network
148s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
11/11/2024, 21:13
General
-
Target
Warzone hack space cheats/Warzone hack.exe
-
Size
2.5MB
-
MD5
3f4540b7b375b6f612c2256998af7c3c
-
SHA1
59d101e0020dcd567c2d0ecc271a0067122caff4
-
SHA256
e6cdd59f34d4bf7707237f377a4b58e1c4060f190068241c406b4c36719d8926
-
SHA512
ef06c781c8fe20b64b3ab7048dee8f84f7bbbfefcf2d91be1eb0206969c01962633c439d4c3929052c6a9c53b834997189f3017c4affc0079f44b29130f0c2d7
-
SSDEEP
24576:F1J/o3viYPYCQllGmmMbOdLDnay9ObwmePSGcWmLhgOL3xGhl3RuQ55313/:F1y3fv+McWmLhgOMl3h
Score
10/10
Malware Config
Extracted
Family
redline
C2
193.106.191.160:8673
Attributes
-
auth_value
4334b1b6304e7a30dd9472e85aa443c9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Warzone hack space cheats\Warzone hack.exe"C:\Users\Admin\AppData\Local\Temp\Warzone hack space cheats\Warzone hack.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
7.7MB