redline | 6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef.exe
Size 206KB
Sample260801-k87csaxtfy
SHA256 6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef
MD5 7860f4ef3245078395a3bb2a3fc855ac
SHA1 3796360e9aa4c623bf1698cdc1b6301115f1aa0c
SHA512 b65e1d5fff968228f3c95769eccfd02c13e9d6857280be470490b774a8c5a64ace8d47527aba46cea2e3c434210587a9dc650621320b4587d8cd4f38cbf1c6d9
SSDEEP 1536:K+qctdmaGi05/n9r8WA3pl38YRvq+L5+bYvv1Vw69JsYgibfbFDKsRE:KM4wfsYRvbLYsBAYgafJlE
TLSH
T180245CA473DE8D65F97C0B70A476011947B4EA0A7423E74F2CCD30DA6F63B4067297AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

@private discovery redline infostealer

Malware Config

Extracted

Family

redline

Botnet

@PRIVATE

185.81.68.115:2920

Attributes

auth_value
1d79e0e64c9e89a46d43760189292e5d

Signatures

Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/3524-1-0x0000000000490000-0x00000000004B8000-memory.dmp	family_redline

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	3524	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef.exe

C:\Users\Admin\AppData\Local\Temp\6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef.exe
"C:\Users\Admin\AppData\Local\Temp\6b72ed6f3ce73e5ef7e82ab380c6ba1d2185d35f7a5c551ee60a42c500ba59ef.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 1020
  2⤵
  - Program crash
  PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3524 -ip 3524
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3524-0-0x00000000748F2000-0x00000000748F3000-memory.dmp

Download

memory/3524-1-0x0000000000490000-0x00000000004B8000-memory.dmp