redline | 3524fcb8275150f465bca3ccf753a3dc3473d5bd29edf80100ee8135df7e6e97

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-30_1575293375ede99102b43f2c6c6352b5_cobalt-strike_sliver.exe
Size

6.0MB
MD5

1575293375ede99102b43f2c6c6352b5
SHA1

a56e9604c5cfcccc0ed4df813aacc709611cddc4
SHA256

3524fcb8275150f465bca3ccf753a3dc3473d5bd29edf80100ee8135df7e6e97
SHA512

8afedb6e26bef5be584d4fffc626976a3632184b853b9ded3bb34ba5dec8c59bc604572a3ef1630bbf352298394265020c4d75121918636f39f727a2705a69b1
SSDEEP

98304:C8iOO/TWUfjFVnFkQAUVzMbompciedNc2uk3ghL1LrRo3YSaG8aD+i73sDWT:Rib/TtfR00Qgbc2uT91HRo3YSaG5+Y7

Score

10^/10

redline vidar discovery infostealer stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Redline family
redline
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-30_1575293375ede99102b43f2c6c6352b5_cobalt-strike_sliver.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-30_1575293375ede99102b43f2c6c6352b5_cobalt-strike_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-30_1575293375ede99102b43f2c6c6352b5_cobalt-strike_sliver.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-0-0x0000000032FD0000-0x00000000334C7000-memory.dmp

Filesize
5.0MB

Download