Analysis
-
max time kernel
110s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22-11-2024 18:26
General
-
Target
4aad97cc0c95e6fa14e2edc38efea25a0cd0bf703664d6cee8dc56ae72b4c06d.exe
-
Size
859KB
-
MD5
4ce03c4d64798295436854f66bd6b65c
-
SHA1
9b361cb195f5debf9f9fcbe42137cb33f93b0081
-
SHA256
4aad97cc0c95e6fa14e2edc38efea25a0cd0bf703664d6cee8dc56ae72b4c06d
-
SHA512
3f11a0250575066146bcba237ae575f6dee9fbc34d05acefddb477d2bbb28664bc82fe66ce1ae3632e450bc524eb307b2286e792b2da8c6d1695f4cf1787398f
-
SSDEEP
12288:YOdplud53QIolhA9s0SjEOm17avNGpWasRDuhyOLQXpC3WFlMZPvyRlgNr8+WGuq:7/g3Q1lhACERAGpWGpU5SXyRSNXD3iv8
Malware Config
Extracted
redline
@tupa187
95.181.152.6:46927
-
auth_value
cdf3919a262c0d6ba99116b375d7551c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
-
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aad97cc0c95e6fa14e2edc38efea25a0cd0bf703664d6cee8dc56ae72b4c06d.exe"C:\Users\Admin\AppData\Local\Temp\4aad97cc0c95e6fa14e2edc38efea25a0cd0bf703664d6cee8dc56ae72b4c06d.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
884KB