redline | 616939c7c18fb2b2003c879f8e5cf41fbd7e4291fda08e969592dcc213ed4941

General

Target

SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe
Size

32KB
MD5

93e0f82e3ead62aa5f6374ccae24a45a
SHA1

2ad7d2537f16fe2012ec4f5ae30db77a3076954e
SHA256

616939c7c18fb2b2003c879f8e5cf41fbd7e4291fda08e969592dcc213ed4941
SHA512

c8bb3dcf9ab6e4f28776be9f4caab98803d51d03a5208a3d624386265cb227cda09a6bd9c8ef76b5e4774b82d7537ce169093fa12a2f91bbc7d834be6a9261e0

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4236-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/4236-9-0x000000000041E192-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe

description pid process target process

PID 4684 set thread context of 4236 4684 SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

4236 AddInProcess32.exe
4236 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.839017.9294.5645.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 4684 SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe
Token: SeDebugPrivilege 4236 AddInProcess32.exe

description	pid	process	target process
PID 4684 set thread context of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe

pid	process
4236	AddInProcess32.exe
4236	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe
Token: SeDebugPrivilege	4236	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe

description	pid	process	target process
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe
PID 4684 wrote to memory of 4236	4684	SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Razy.839017.9294.5645.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4236-17-0x0000000005BE0000-0x0000000005BE1000-memory.dmp

Filesize
4KB

Download
memory/4236-23-0x0000000006E50000-0x0000000006E51000-memory.dmp

Filesize
4KB

Download
memory/4236-18-0x0000000005C40000-0x0000000005C41000-memory.dmp

Filesize
4KB

Download
memory/4236-27-0x00000000071A0000-0x00000000071A1000-memory.dmp

Filesize
4KB

Download
memory/4236-26-0x0000000005391000-0x0000000005392000-memory.dmp

Filesize
4KB

Download
memory/4236-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4236-9-0x000000000041E192-mapping.dmp

Download
memory/4236-10-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/4236-19-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/4236-16-0x0000000006160000-0x0000000006161000-memory.dmp

Filesize
4KB

Download
memory/4236-28-0x0000000008D70000-0x0000000008D71000-memory.dmp

Filesize
4KB

Download
memory/4236-25-0x0000000006EF0000-0x0000000006EF1000-memory.dmp

Filesize
4KB

Download
memory/4236-14-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/4236-20-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

Filesize
4KB

Download
memory/4236-21-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/4236-22-0x0000000007380000-0x0000000007381000-memory.dmp

Filesize
4KB

Download
memory/4236-24-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/4684-3-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/4684-5-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/4684-7-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/4684-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/4684-2-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads