redline | 4c8d1a1d118384df23575d4421f573f9b97d984b295083b329a8ee08709dcfce

Analysis

Target

9912ba933918d4b6049652e42804aeab.exe
Size

316KB
MD5

9912ba933918d4b6049652e42804aeab
SHA1

0c93792ee245ef911fe437b66380894d5cac8cca
SHA256

4c8d1a1d118384df23575d4421f573f9b97d984b295083b329a8ee08709dcfce
SHA512

17cf13f13464c5d31ec3555d659415c48612d498073dab22388bb787a8348d9e3cbba94a7ff0e43005525e28bfc44138a770c4a9ced0bb8e7fb5c7f003af26e0

Score

10^/10

Family

redline

Botnet

118

bumblebee2021.store:80

trusmileveneers.store:80

lazerprojekt.store:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1840-114-0x0000000002350000-0x000000000236E000-memory.dmp	family_redline
behavioral2/memory/1840-116-0x00000000024D0000-0x00000000024ED000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9912ba933918d4b6049652e42804aeab.exe

description pid process

Token: SeDebugPrivilege 1840 9912ba933918d4b6049652e42804aeab.exe

description	pid	process
Token: SeDebugPrivilege	1840	9912ba933918d4b6049652e42804aeab.exe

C:\Users\Admin\AppData\Local\Temp\9912ba933918d4b6049652e42804aeab.exe
"C:\Users\Admin\AppData\Local\Temp\9912ba933918d4b6049652e42804aeab.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

memory/1840-114-0x0000000002350000-0x000000000236E000-memory.dmp

Filesize
120KB

Download
memory/1840-115-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/1840-116-0x00000000024D0000-0x00000000024ED000-memory.dmp

Filesize
116KB

Download
memory/1840-117-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/1840-118-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1840-119-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/1840-120-0x0000000000610000-0x0000000000640000-memory.dmp

Filesize
192KB

Download
memory/1840-121-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1840-122-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/1840-124-0x0000000004B43000-0x0000000004B44000-memory.dmp

Filesize
4KB

Download
memory/1840-123-0x0000000004B42000-0x0000000004B43000-memory.dmp

Filesize
4KB

Download
memory/1840-125-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/1840-126-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1840-127-0x0000000004B44000-0x0000000004B46000-memory.dmp

Filesize
8KB

Download