Analysis
- max time kernel
149s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
30/06/2026, 19:06
General
- Target Launcher/updater/GUP.exe
- Size 255KB
- Sample260630-xsen2sf14s
- SHA256 68fe7a43de6a2ea86da2d13d253c275b37933b5028fcc37ed6ac569849670f90
Malware Config
Extracted
-
redline
-
45.15.157.131:36457
-
auth_value
9848b9d66e2e3ff4033fb5f6013c451b
Signatures
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher\updater\GUP.exe"C:\Users\Admin\AppData\Local\Temp\Launcher\updater\GUP.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3756 -ip 37561⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2772-1-0x0000000000450000-0x0000000000480000-memory.dmp
memory/2772-6-0x00000000052F0000-0x0000000005908000-memory.dmp
memory/2772-7-0x0000000004E60000-0x0000000004F6A000-memory.dmp
memory/2772-8-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/2772-9-0x0000000004D90000-0x0000000004DA2000-memory.dmp
memory/2772-10-0x0000000004DF0000-0x0000000004E2C000-memory.dmp
memory/2772-11-0x0000000004F70000-0x0000000004FBC000-memory.dmp
memory/2772-12-0x00000000050A0000-0x00000000050B0000-memory.dmp
memory/3756-0-0x0000000000C3B000-0x0000000000C3C000-memory.dmp