redline | 5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca

Analysis

max time kernel
132s
max time network
146s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca.exe
Size

168KB
MD5

e98c7f9ef4987ea6255fb0adfe741899
SHA1

82b10cc9f7e7237a722a0e80910aa1659945841b
SHA256

5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca
SHA512

4a63060c53b1642c3bd5b49e462dc44081877171659b892b49c032642031421cf4fb05141aaef500582aaf287169ebb018364bde91eb146710550c32248ddaa8
SSDEEP

3072:uJaohQaSe5clFcb0iCKbqVsTQZxTcVL8e8h2D:uJteaSe5clhiVwxTcVL5

Score

10^/10

redline mazda discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

mazda

217.196.96.56:4138

Attributes

auth_value
3d2870537d84a4c6d7aeecd002871c51

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3012-1-0x0000000000040000-0x0000000000070000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca.exe

C:\Users\Admin\AppData\Local\Temp\5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca.exe
"C:\Users\Admin\AppData\Local\Temp\5467f8a86a1339347b22947614ae08bcf120152ff1448e297297fb62595c32ca.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000040000-0x0000000000070000-memory.dmp

Filesize
192KB

Download
memory/3012-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3012-3-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-4-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Filesize
4KB

Download
memory/3012-5-0x0000000074DE0000-0x00000000754CE000-memory.dmp

Filesize
6.9MB

Download