redline | 57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe
Size 234KB
Sample260703-m965hsfz21
SHA256 57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515
MD5 c2548034394c074150a54ab7e72efb36
SHA1 55f455ba3751b633ac3db5cf653fae4857315d50
SHA512 373db77a3928c1f41fd955a7edca3db574a0bb8b8185de73750282c3ea195739ebb85b04130ecb6e9a546c6c51e02820e5ed3dc09dc43d04114bfe9c18bb7c3c
SSDEEP 6144:z8zS6vxU/6QKR0rPp6oOkSzkz1HbMAKKZqNP5EOp6K/fw4t+DuWfs:3OxLeGz2+Ys7
TLSH
T1EA34DF82A3E6BE80CBDC55F550F14804B7B9F6A3014FDB8B14A860747B26374D6EE993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery redline infostealer

Malware Config

Extracted

Family

redline

185.196.9.26:6302

Signatures

Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3476-7-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Loads dropped DLL 1 IoCs

pid	Process
592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 592 set thread context of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89
PID 592 wrote to memory of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89
PID 592 wrote to memory of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89
PID 592 wrote to memory of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89
PID 592 wrote to memory of 3476	592	57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe	89

C:\Users\Admin\AppData\Local\Temp\57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe
"C:\Users\Admin\AppData\Local\Temp\57f4d4262b445007da09da0fb214b81666dbfa6d1e2f28d8b2b3a91b568ae515.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d3d9.dll

Path C:\Users\Admin\AppData\Roaming\d3d9.dll
Size 469KB
SHA256 f910a82fe9a38800c04f2819bd4594ea5f2a5d2fbf50e3cc09c4b9a50de8d829
MD5 af978dd3a76bde88b317a31fe3c8f420
SHA1 16aa518701d26b4986af183fa241cec7cee97cee
SHA512 2078c4ef7ca90caf39e78f8a7321b0e07077840e764a0a6d49e3fe14397d8b7a131f47ab5d6fc216dc0d6d582d54b1c4c00e1e69743c418272eb38b79142059e
SSDEEP 6144:NR9WBHeeZm37vzja9V2PyONjig/ybj5Nm4fKqi/kDfh0bHJnnh5L9V4sdpEu:q+eZmwVvO8J0bppVZ
TLSH
T1C4A45B8BEC2CC78AF968CC32B424216D2B18DE704D7448875FDA69583EA1DDC5DF53A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-0-0x0000000000EE0000-0x0000000000F20000-memory.dmp

Download

memory/3476-12-0x0000000005990000-0x000000000599A000-memory.dmp

Download

memory/3476-9-0x0000000005D00000-0x00000000062A4000-memory.dmp

Download

memory/3476-10-0x00000000057F0000-0x0000000005882000-memory.dmp

Download

memory/3476-11-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

memory/3476-7-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3476-13-0x00000000068D0000-0x0000000006EE8000-memory.dmp

Download

memory/3476-14-0x00000000062B0000-0x00000000063BA000-memory.dmp

Download

memory/3476-15-0x0000000005BC0000-0x0000000005BD2000-memory.dmp

Download

memory/3476-16-0x0000000005C20000-0x0000000005C5C000-memory.dmp

Download

memory/3476-17-0x0000000005C70000-0x0000000005CBC000-memory.dmp

Download

memory/3476-18-0x00000000059E0000-0x00000000059F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads