Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 17:33
General
-
Target
rBUo_Q51tM81Zz_hOeaiPK11.exe
-
Size
356KB
-
MD5
81c9b42b9a46e50981d3f078688ade0c
-
SHA1
fa0bb118655fa260855b18f73b49358b389b7bcd
-
SHA256
01b9ae05c0c5d50490c05aa2e2873b77a71792adf7c9fb0a1205780a70547192
-
SHA512
e26e3fab4bb855f0c4a838c32b49e4c1530e6bc3eddc9163c9f1f0c3e1c9ddacfadc40ae21108a3938b642d9c7c82905be83badee0c58eec5e1f2934587b950c
-
SSDEEP
6144:3ShHvmmMtHKD/FyOPcg/F/5MlGzbgsfcMVu4nKGfmQbmxO:ihPJMtHK7Fh0Gbgxx4n9f
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
@Germany
C2
194.26.135.162:2920
Attributes
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
Redline family
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rBUo_Q51tM81Zz_hOeaiPK11.exe"C:\Users\Admin\AppData\Local\Temp\rBUo_Q51tM81Zz_hOeaiPK11.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 11242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 43361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
244KB
-
Filesize
256KB
-
Filesize
176KB
-
Filesize
31.0MB
-
Filesize
5.6MB
-
Filesize
160KB
-
Filesize
584KB
-
Filesize
1024KB
-
Filesize
256KB
-
Filesize
244KB
-
Filesize
31.0MB