redline | 97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984

Analysis

max time kernel
133s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-02-2025 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984.exe
Size

300KB
MD5

4a13cca1b960fd69697a4c69105c851c
SHA1

3a71263e57ffa4a056bbb649d7173dbf7046c1da
SHA256

97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984
SHA512

d411ac647b6dececf30c8823d8cebf68848817338ce143030219688f0b32852fbc52721089a74ec98ce05e46532a55483b689bc446610a94e4fa029f5b885c72
SSDEEP

3072:ecZqf7D34Bp/0+mAwkyg4eQEgPQB1fA0PuTVAtkxze3RweqiOL2bBOA:ecZqf7DITnWVcB1fA0GTV8kUQL

Score

10^/10

redline danek discovery infostealer

Malware Config

Extracted

Family

redline

Botnet

DANEK

195.177.92.88:1912

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2124-1-0x0000000000BF0000-0x0000000000C42000-memory.dmp	family_redline

Redline family
redline

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984.exe

C:\Users\Admin\AppData\Local\Temp\97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984.exe
"C:\Users\Admin\AppData\Local\Temp\97b8e017d9459357292e3e25e0a343aedcaf28c18ec4a05985995a0be9495984.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2124-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2124-1-0x0000000000BF0000-0x0000000000C42000-memory.dmp

Filesize
328KB

Download
memory/2124-2-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-3-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2124-4-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download