redline | e876f64f562cb894ae5ae5ef8cddc4d126f94eb2013a06b3814f879f7be98970

Analysis

Target

edd90288b6ed1442d74ac93c72f090a8.exe
Size

333KB
MD5

edd90288b6ed1442d74ac93c72f090a8
SHA1

8ef556616fd07dbc875bf2338338f9f83e67ca5b
SHA256

e876f64f562cb894ae5ae5ef8cddc4d126f94eb2013a06b3814f879f7be98970
SHA512

d1f03c4b130569d7624a3a1a8076d1d8e948f45874a66484a8bb98809ee99fe78dee79940469d96739db58b759c3998bce1fb8d78e903c7e6b600dac81f0c7b4

Score

10^/10

Family

redline

Botnet

118

bumblebee2021.store:80

trusmileveneers.store:80

lazerprojekt.store:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1736-116-0x0000000004900000-0x000000000491E000-memory.dmp	family_redline
behavioral2/memory/1736-118-0x0000000004C00000-0x0000000004C1D000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

edd90288b6ed1442d74ac93c72f090a8.exe

description pid process

Token: SeDebugPrivilege 1736 edd90288b6ed1442d74ac93c72f090a8.exe

description	pid	process
Token: SeDebugPrivilege	1736	edd90288b6ed1442d74ac93c72f090a8.exe

C:\Users\Admin\AppData\Local\Temp\edd90288b6ed1442d74ac93c72f090a8.exe
"C:\Users\Admin\AppData\Local\Temp\edd90288b6ed1442d74ac93c72f090a8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736

memory/1736-114-0x0000000002C80000-0x0000000002D2E000-memory.dmp

Filesize
696KB

Download
memory/1736-116-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/1736-117-0x0000000007420000-0x0000000007421000-memory.dmp

Filesize
4KB

Download
memory/1736-118-0x0000000004C00000-0x0000000004C1D000-memory.dmp

Filesize
116KB

Download
memory/1736-115-0x0000000000400000-0x0000000002BC3000-memory.dmp

Filesize
39.8MB

Download
memory/1736-121-0x00000000048E2000-0x00000000048E3000-memory.dmp

Filesize
4KB

Download
memory/1736-119-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/1736-122-0x00000000048E3000-0x00000000048E4000-memory.dmp

Filesize
4KB

Download
memory/1736-120-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/1736-123-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1736-124-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1736-125-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1736-126-0x00000000048E4000-0x00000000048E6000-memory.dmp

Filesize
8KB

Download
memory/1736-127-0x0000000008030000-0x0000000008031000-memory.dmp

Filesize
4KB

Download