redline | 41ff1e7d1148b7336cec20f3d4962a0bfa978b4d90b465a9706d1599ff10e2c2

General

Target

8fadcccda55d5f61a52a73fc6d956265.exe
Size

27KB
MD5

8fadcccda55d5f61a52a73fc6d956265
SHA1

84ffc3bcc14f4ca2c3cfdbef7cbe65f33b9b038a
SHA256

41ff1e7d1148b7336cec20f3d4962a0bfa978b4d90b465a9706d1599ff10e2c2
SHA512

90df3dcc345a54aa5797336ce9b55d11aea430840220e7a2cf85407752372cf4cbc1960f0970a1494278cb07503c1ef27d35c379affc6a264c26b400222a26c8

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

8fadcccda55d5f61a52a73fc6d956265.exe

description pid process target process

PID 3584 set thread context of 744 3584 8fadcccda55d5f61a52a73fc6d956265.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AddInProcess32.exe

pid process

744 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

8fadcccda55d5f61a52a73fc6d956265.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 3584 8fadcccda55d5f61a52a73fc6d956265.exe
Token: SeDebugPrivilege 744 AddInProcess32.exe

description	pid	process	target process
PID 3584 set thread context of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe

pid	process
744	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	3584	8fadcccda55d5f61a52a73fc6d956265.exe
Token: SeDebugPrivilege	744	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8fadcccda55d5f61a52a73fc6d956265.exe

description	pid	process	target process
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe
PID 3584 wrote to memory of 744	3584	8fadcccda55d5f61a52a73fc6d956265.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\8fadcccda55d5f61a52a73fc6d956265.exe
"C:\Users\Admin\AppData\Local\Temp\8fadcccda55d5f61a52a73fc6d956265.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-17-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/744-24-0x00000000078C0000-0x00000000078C1000-memory.dmp

Filesize
4KB

Download
memory/744-14-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/744-25-0x0000000006A00000-0x0000000006A01000-memory.dmp

Filesize
4KB

Download
memory/744-16-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/744-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/744-9-0x000000000041E892-mapping.dmp

Download
memory/744-23-0x0000000006960000-0x0000000006961000-memory.dmp

Filesize
4KB

Download
memory/744-26-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x0000000006E90000-0x0000000006E91000-memory.dmp

Filesize
4KB

Download
memory/744-10-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/744-18-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/744-19-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/744-20-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/744-21-0x0000000006790000-0x0000000006791000-memory.dmp

Filesize
4KB

Download
memory/3584-3-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/3584-2-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/3584-7-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/3584-6-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/3584-5-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads