Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10-01-2025 14:41

General

  • Target

    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe

  • Size

    852KB

  • MD5

    1cd6afe88ba532ca70c927d90314eac8

  • SHA1

    3e5c107a20bad54a81ec0cb7e18e4dddcfca003b

  • SHA256

    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953

  • SHA512

    d338745cc39ad49e6d94251d2bbc2dc2c2af77ee37fe4fd952ea765a3159e45adb2da316fab36a2f39344d87ed37c0eac91a4f1026e5c31936f38e7a28f2d3bd

  • SSDEEP

    24576:yuxXOKVpvO/cmyGMELxcPZrUm/t3rwFO:rxXdfOEOM6SPtUCQ

Malware Config

Extracted

Family

redline

Botnet

LOGS

C2

87.120.120.86:1912

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    "C:\Users\Admin\AppData\Local\Temp\e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
      "C:\Users\Admin\AppData\Local\Temp\e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2884

Network

    No results found
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    152 B
    3
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    152 B
    3
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    152 B
    3
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    152 B
    3
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    152 B
    3
  • 87.120.120.86:1912
    e14cf1238643d04a93157a0416329f7f8b08a9ceff996b870be593df328d6953.exe
    52 B
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1500-0-0x000000007474E000-0x000000007474F000-memory.dmp

    Filesize

    4KB

  • memory/1500-1-0x0000000000B90000-0x0000000000C6A000-memory.dmp

    Filesize

    872KB

  • memory/1500-2-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1500-3-0x00000000020C0000-0x00000000020DE000-memory.dmp

    Filesize

    120KB

  • memory/1500-4-0x000000007474E000-0x000000007474F000-memory.dmp

    Filesize

    4KB

  • memory/1500-5-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1500-6-0x0000000006170000-0x0000000006206000-memory.dmp

    Filesize

    600KB

  • memory/1500-21-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2884-18-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-14-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-19-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2884-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2884-20-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2884-11-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-9-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-8-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-17-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-7-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2884-22-0x0000000074740000-0x0000000074E2E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.