redline | 63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036

General

Target

omar.exe
Size

1.2MB
MD5

13db34cab435d9858269c5e823f4b575
SHA1

c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
SHA256

63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
SHA512

dfd36c39b35cf1aed2b76e38d4a08c41792611cf886d337d129a19c963878cc53fb7a0d71e078d2d38e61d8341a938869686f62673f080a7182020cd08c2c6a8

Score

10^/10

redline omar infostealer

Malware Config

Extracted

Family

redline

Botnet

omar

C2

217.12.209.28:44444

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/752-124-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/752-125-0x000000000041654E-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

omar.exe

description pid process target process

PID 3212 set thread context of 752 3212 omar.exe omar.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

omar.exe

description pid process

Token: SeDebugPrivilege 752 omar.exe

description	pid	process	target process
PID 3212 set thread context of 752	3212	omar.exe	omar.exe

description	pid	process
Token: SeDebugPrivilege	752	omar.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

omar.exe

description	pid	process	target process
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe
PID 3212 wrote to memory of 752	3212	omar.exe	omar.exe

C:\Users\Admin\AppData\Local\Temp\omar.exe
"C:\Users\Admin\AppData\Local\Temp\omar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\AppData\Local\Temp\omar.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\omar.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/752-124-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/752-134-0x00000000052D0000-0x00000000058D6000-memory.dmp

Filesize
6.0MB

Download
memory/752-133-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/752-132-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/752-131-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/752-130-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/752-129-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/752-125-0x000000000041654E-mapping.dmp

Download
memory/3212-119-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/3212-123-0x000000000B170000-0x000000000B1CB000-memory.dmp

Filesize
364KB

Download
memory/3212-122-0x0000000008AD0000-0x0000000008B77000-memory.dmp

Filesize
668KB

Download
memory/3212-121-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

Filesize
4KB

Download
memory/3212-120-0x0000000005670000-0x0000000005675000-memory.dmp

Filesize
20KB

Download
memory/3212-114-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3212-118-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/3212-117-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/3212-116-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads