redline | e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b.exe
Size

103KB
MD5

2610283e2657fe416300a9336c1acb8b
SHA1

e343d45228e6b4f503af60a61aa1c183a1d29e1c
SHA256

e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b
SHA512

5498167645535a757d58df1af3fe5219ead21fe592b8ad886e8b9727fc61561401ff2ec0ce9095c1bb2f93d21d3a37cdb53b9037885fc1c77f55ae61a06a91ce
SSDEEP

3072:GsN6IYEQ0ASNwr/vUwQ3dhReff6ub8PXXY:uSN2LtkXXY

Score

10^/10

redline builder discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

builder

65.108.14.118:53868

Attributes

auth_value
0aa1accf6b8c22c36f0ecf0d20dd081e

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1388-1-0x0000000000C60000-0x0000000000C80000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b.exe

C:\Users\Admin\AppData\Local\Temp\e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b.exe
"C:\Users\Admin\AppData\Local\Temp\e4a3f9abbd35f2dd065e1b8b8b2c938e254212811700da3e4bfc17bfcdf3494b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-0-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/1388-1-0x0000000000C60000-0x0000000000C80000-memory.dmp

Filesize
128KB

Download
memory/1388-2-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/1388-3-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/1388-4-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download