redline | 2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17.exe
Size

104KB
MD5

ba8b55a96e88ceaec6c2170b7b0a14b5
SHA1

53fb893fa25cbf4adda4e0d8afdc017430fedcb4
SHA256

2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17
SHA512

bb1bc61f234afd2f5e0920bbbb0a0af6e245e04789a0dc5ce258513f18b8b9fa24c2aafb9448d7e14dedc0b1e6a3423b9654c05ff5c31771a87f5b76533dc1a2
SSDEEP

3072:pag0s5bLjlp5qg0mJvVNbk7gMZPV4IJvBZn9Zq:xTbLjlp5qg0ENraDdvq

Score

10^/10

redline roocrash v2.5 discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

RooCrash V2.5

92.246.89.23:21869

Attributes

auth_value
de96507e639360f7a16601c22d57c808

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/580-1-0x0000000001190000-0x00000000011B0000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17.exe

C:\Users\Admin\AppData\Local\Temp\2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17.exe
"C:\Users\Admin\AppData\Local\Temp\2c4efdfb19431bd2ec167338854f543bbd8ab23006998655a3e873edb305dc17.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-0-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/580-1-0x0000000001190000-0x00000000011B0000-memory.dmp

Filesize
128KB

Download
memory/580-2-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/580-3-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/580-4-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download