redline | 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00

Analysis

max time kernel
59s
max time network
62s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hwid-changer-games-main/HardDiskSerialNumberChanger.exe
Size 237KB
Sample260731-vesbwack71
SHA256 87fb385f96247a701a227e173041d47783befa873e8ab8ee9c886a918369fe00
MD5 ecc630a923e295240c465000e939d897
SHA1 d24ea1e7bc9b05312e31f05a26222ab4effd664b
SHA512 d0425c7e69d5ba15903b40055ce0e72fc4b8fd59cf58018cc89fc2fe268739e3b470ca63db0b6fda7e0c87fbb70d207fbc9ae51ee607b33d494908437a825eb8
SSDEEP 6144:QBTDgheuMo6jfztgkbwoWjG6aB3ZyCvrhF44bozBAMx1A7+gvo1:QZzjAhi6aB3ZyCvrhF44bozaMx1p
TLSH
T1F634D603BD9AC961C75CE432EC7F03DA806A259231EE185C8B1615CB793F7A05E3696F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery redline infostealer

Malware Config

Extracted

Family

redline

37.220.87.13:48790

Attributes

auth_value
1edd2fb73ce1cefef7757295d049e227

Signatures

Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/memory/5588-1-0x0000000000400000-0x0000000000436000-memory.dmp	family_redline
behavioral3/memory/5052-12-0x0000000000DD0000-0x0000000000E11000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5052 set thread context of 5588	5052	HardDiskSerialNumberChanger.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	5052	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HardDiskSerialNumberChanger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 5588	5052	HardDiskSerialNumberChanger.exe	83
PID 5052 wrote to memory of 5588	5052	HardDiskSerialNumberChanger.exe	83

C:\Users\Admin\AppData\Local\Temp\hwid-changer-games-main\HardDiskSerialNumberChanger.exe
"C:\Users\Admin\AppData\Local\Temp\hwid-changer-games-main\HardDiskSerialNumberChanger.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 292
  2⤵
  - Program crash
  PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5052 -ip 5052
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5052-0-0x0000000000E09000-0x0000000000E0A000-memory.dmp

Download

memory/5052-12-0x0000000000DD0000-0x0000000000E11000-memory.dmp

Download

memory/5588-1-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/5588-6-0x0000000005E00000-0x0000000006418000-memory.dmp

Download

memory/5588-7-0x0000000005820000-0x0000000005832000-memory.dmp

Download

memory/5588-8-0x0000000005950000-0x0000000005A5A000-memory.dmp

Download

memory/5588-9-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

memory/5588-10-0x0000000005880000-0x00000000058BC000-memory.dmp

Download

memory/5588-11-0x0000000005900000-0x000000000594C000-memory.dmp

Download

memory/5588-13-0x00000000058F0000-0x0000000005900000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads