redline | fc7da967f86d24024700aa2a488ae2ce18c038260d9e2d5067261c9bedbcfaf0

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5ceb18f10606859253493d936ae2815b3fed26.exe
Size

647KB
MD5

ac39e7b10284fe04e5bdb8b588681cb4
SHA1

2b5ceb18f10606859253493d936ae2815b3fed26
SHA256

fc7da967f86d24024700aa2a488ae2ce18c038260d9e2d5067261c9bedbcfaf0
SHA512

0fbff528fe6962f4695be585e8a666af8d4576d75cf37d20e95658e7b1d81bebc0e308b7c4032be139768b077b08e19ed9d474d04a87c0609bac04258ccde809
SSDEEP

12288:tHQNnEONUb9/6VQBDthHcUzsMyl2zkoF:tqnEldUUfyl2z

Score

10^/10

redline discovery infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2164-1-0x0000000000160000-0x0000000000208000-memory.dmp	family_redline

Redline family
redline

Loads dropped DLL 1 IoCs

pid	Process
2164	2b5ceb18f10606859253493d936ae2815b3fed26.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2b5ceb18f10606859253493d936ae2815b3fed26.exe

C:\Users\Admin\AppData\Local\Temp\2b5ceb18f10606859253493d936ae2815b3fed26.exe
"C:\Users\Admin\AppData\Local\Temp\2b5ceb18f10606859253493d936ae2815b3fed26.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\gdi32.dll

Filesize
635KB

MD5
07ce16eb6b4643175ac5acc3a15cc02a

SHA1
51834d46a39105f65d3972e0b79c75a5b1a1cbd2

SHA256
174aa2135cbb50558ff4e54a4ba11a4b828559dfd0c31fb0463a364fc532bb9d

SHA512
e117fce03f171efa94128ca821a2de0504f72b565e7f15de8fcd54fbc2477b1ac817c966fef4edf39ea02a9ca30e3bff8fd51ef96a326729662cf96c7ef38bed

Download Submit
memory/2164-0-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/2164-1-0x0000000000160000-0x0000000000208000-memory.dmp

Filesize
672KB

Download
memory/2164-6-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download