redline | 002169163197e9a6fbe52c9d5cad8e901e52613d2ff4efbe2ccac367cea51af9

General

Target

14e44f49785c8ded87796a6da24f7130.exe
Size

638KB
MD5

14e44f49785c8ded87796a6da24f7130
SHA1

3e33b7b9c9fe6d2f7b7989d30ea0eb710fac9abe
SHA256

002169163197e9a6fbe52c9d5cad8e901e52613d2ff4efbe2ccac367cea51af9
SHA512

4c43222fe7c6ae101a767ffac21ca70654e95b5f774f89522a3fee2a1f4a1f2530797d3b9d65e2167e0bcd73844b47c941189facdd08101ead00bb7992437ae7

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1416-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/1416-9-0x000000000041EFD6-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

14e44f49785c8ded87796a6da24f7130.exe

description pid process target process

PID 1192 set thread context of 1416 1192 14e44f49785c8ded87796a6da24f7130.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AddInProcess32.exe

pid process

1416 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

14e44f49785c8ded87796a6da24f7130.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 1192 14e44f49785c8ded87796a6da24f7130.exe
Token: SeDebugPrivilege 1416 AddInProcess32.exe

description	pid	process	target process
PID 1192 set thread context of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe

pid	process
1416	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1192	14e44f49785c8ded87796a6da24f7130.exe
Token: SeDebugPrivilege	1416	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

14e44f49785c8ded87796a6da24f7130.exe

description	pid	process	target process
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe
PID 1192 wrote to memory of 1416	1192	14e44f49785c8ded87796a6da24f7130.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\14e44f49785c8ded87796a6da24f7130.exe
"C:\Users\Admin\AppData\Local\Temp\14e44f49785c8ded87796a6da24f7130.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-2-0x0000000073A80000-0x000000007416E000-memory.dmp

Filesize
6.9MB

Download
memory/1192-3-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1192-5-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1192-6-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/1192-7-0x0000000004FE0000-0x0000000004FF7000-memory.dmp

Filesize
92KB

Download
memory/1416-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1416-9-0x000000000041EFD6-mapping.dmp

Download
memory/1416-10-0x0000000073A80000-0x000000007416E000-memory.dmp

Filesize
6.9MB

Download
memory/1416-13-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1416-14-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1416-15-0x0000000005E70000-0x0000000005E71000-memory.dmp

Filesize
4KB

Download
memory/1416-16-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/1416-17-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/1416-18-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/1416-19-0x0000000005980000-0x0000000005981000-memory.dmp

Filesize
4KB

Download
memory/1416-20-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/1416-21-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/1416-22-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/1416-24-0x0000000007E40000-0x0000000007E41000-memory.dmp

Filesize
4KB

Download
memory/1416-25-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

Filesize
4KB

Download
memory/1416-26-0x0000000007B40000-0x0000000007B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads