redline | c4e42ebfd487b325ece4f09d75687c96e252aa8559f8a8daad6336dc39ee5424

General

Target

SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe
Size

860KB
MD5

21ee9c5c9c5b5d42689ce6814685409f
SHA1

a839162b6d7bf0da080de3e5937c1f6c4452a93d
SHA256

c4e42ebfd487b325ece4f09d75687c96e252aa8559f8a8daad6336dc39ee5424
SHA512

a97f73a320a6b5a5e34c29c162644a2f93aa03c26609c41702b7d9e89a733ba7ea135fcc3d7eabf73a7e3bd8a5fe02048efddda22f469eb311ad263d41756dd4

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2456-5-0x0000000000400000-0x000000000042E000-memory.dmp	family_redline
behavioral2/memory/2456-6-0x0000000000429E9E-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe

description pid process target process

PID 3980 set thread context of 2456 3980 SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe RegAsm.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4008 taskkill.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

2456 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 2456 RegAsm.exe
Token: SeDebugPrivilege 4008 taskkill.exe

description	pid	process	target process
PID 3980 set thread context of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe

pid	process
4008	taskkill.exe

pid	process
2456	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2456	RegAsm.exe
Token: SeDebugPrivilege	4008	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exeRegAsm.execmd.exe

description	pid	process	target process
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 3980 wrote to memory of 2456	3980	SecuriteInfo.com.Gen.Variant.Razy.624632.31255.13122.exe	RegAsm.exe
PID 2456 wrote to memory of 3472	2456	RegAsm.exe	cmd.exe
PID 2456 wrote to memory of 3472	2456	RegAsm.exe	cmd.exe
PID 2456 wrote to memory of 3472	2456	RegAsm.exe	cmd.exe
PID 3472 wrote to memory of 4008	3472	cmd.exe	taskkill.exe
PID 3472 wrote to memory of 4008	3472	cmd.exe	taskkill.exe
PID 3472 wrote to memory of 4008	3472	cmd.exe	taskkill.exe
PID 3472 wrote to memory of 2320	3472	cmd.exe	choice.exe
PID 3472 wrote to memory of 2320	3472	cmd.exe	choice.exe
PID 3472 wrote to memory of 2320	3472	cmd.exe	choice.exe

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 2456 && choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3472

memory/2320-18-0x0000000000000000-mapping.dmp

Download
memory/2456-14-0x0000000005B60000-0x0000000005B61000-memory.dmp

Filesize
4KB

Download
memory/2456-7-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/2456-15-0x0000000005D10000-0x0000000005D11000-memory.dmp

Filesize
4KB

Download
memory/2456-13-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/2456-11-0x0000000006020000-0x0000000006021000-memory.dmp

Filesize
4KB

Download
memory/2456-6-0x0000000000429E9E-mapping.dmp

Download
memory/2456-12-0x0000000005AC0000-0x0000000005AC1000-memory.dmp

Filesize
4KB

Download
memory/2456-10-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/2456-5-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3472-16-0x0000000000000000-mapping.dmp

Download
memory/3980-2-0x0000000004D30000-0x0000000004DEE000-memory.dmp

Filesize
760KB

Download
memory/3980-4-0x0000000004C60000-0x0000000004D1C000-memory.dmp

Filesize
752KB

Download
memory/3980-0-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/3980-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/3980-1-0x00000000738B0000-0x0000000073F9E000-memory.dmp

Filesize
6.9MB

Download
memory/4008-17-0x0000000000000000-mapping.dmp

Download