Analysis
-
max time kernel
132s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 20:39
Behavioral task
behavioral1
Sample
092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4N.exe
Resource
win10v2004-20241007-en
General
-
Target
092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4N.exe
-
Size
176KB
-
MD5
fa80bde05bc7a3d6557d3cbc1233e4f0
-
SHA1
b029397629503203fc9816d248860a4254f0cb66
-
SHA256
092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4
-
SHA512
8c9e31e2e52980f303caa61cc7876a8ffbd561fd7dbfd34bacfdbc1196d4adbdb4e71a5495d244a5d5f54cdc37ff9811dbe2ea57ae6dd814a14b430c299892ff
-
SSDEEP
3072:pxqZWzvagwoMR3I58ZlHeR5FthXfxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOb:bqZVY8qth
Malware Config
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5032-1-0x0000000000110000-0x0000000000142000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4N.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 092b5ca5621b2a04c93f3127c2cccb75bf26f5b314dac20c9cfc78336cfb49f4N.exe