Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 12:57
General
-
Target
6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64.exe
-
Size
2.4MB
-
MD5
b3998f79a78baef7cf93c7e26b07d16b
-
SHA1
45127505d72584c690418d81c7f2b24cb7ffe84d
-
SHA256
6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64
-
SHA512
9927feba765d7f17f16e5daccac7065801e241c4c6a1f1045e784e72d5ef5c71ca57d67ee6e24009b0af67b44d98248d0019d9b2f63332b4e77697b158afc282
-
SSDEEP
24576:eBP8ORYWYNzBqY/M9mo6ernms16sloTzR5SXggBMVmnL9RLr3Pl3RuQ55313V:eR8jMfloTF5SJMVmnL9Rnl3P
Malware Config
Extracted
redline
@jeamoff
5.182.36.101:31305
-
auth_value
7c2fde5fc33439094a0b76dd7b33f7cd
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64.exe"C:\Users\Admin\AppData\Local\Temp\6cc44d98ce2fb628b25519eb2aa476b81c1dca23b4c11fb3f26951bba8e68d64.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB