redline | 154df0e5a18c811df58c1fab786001c5aa9d3a80640793578759a15a34597acb

General

Target

Slaking.exe
Size

35KB
MD5

77df4a375a27bfecc3c44317eff75bdc
SHA1

49f11fad9a2522f198fa4cbe2df89171781177d3
SHA256

154df0e5a18c811df58c1fab786001c5aa9d3a80640793578759a15a34597acb
SHA512

42bf0500231241f953cea5c415afe37d60a8942ecd6cb0b7e79c42a24a1013b0989dcb3587068a6bcee77b2271c1ca9484d64f3a3791681949edc723b1f37a1b

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2408-8-0x00000000026A0000-0x00000000026C3000-memory.dmp	family_redline
behavioral2/memory/2408-10-0x0000000004D60000-0x0000000004D82000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

Slaking.exe

description pid process target process

PID 2868 set thread context of 2408 2868 Slaking.exe AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Slaking.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 2868 Slaking.exe
Token: SeDebugPrivilege 2408 AddInProcess32.exe

description	pid	process	target process
PID 2868 set thread context of 2408	2868	Slaking.exe	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2868	Slaking.exe
Token: SeDebugPrivilege	2408	AddInProcess32.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Slaking.exe

description	pid	process	target process
PID 2868 wrote to memory of 2580	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2580	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2580	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2348	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2348	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2348	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe
PID 2868 wrote to memory of 2408	2868	Slaking.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:2348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

memory/2408-7-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-9-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/2408-3-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2408-4-0x000000000040CD2F-mapping.dmp

Download
memory/2408-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2408-6-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2408-15-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2408-8-0x00000000026A0000-0x00000000026C3000-memory.dmp

Filesize
140KB

Download
memory/2408-14-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/2408-10-0x0000000004D60000-0x0000000004D82000-memory.dmp

Filesize
136KB

Download
memory/2408-11-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/2408-12-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2408-13-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download
memory/2868-0-0x0000000073820000-0x0000000073F0E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-1-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download