redline | b5088e71620e86cf712292d9e7a29320f26c58b711217722ed9a500484ceea52

General

Target

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Size

708KB
MD5

db874c5199ae1f20b31fc9d419c6da65
SHA1

f670e09bcb0b4e22ca34acccaa73145d23e5113a
SHA256

b5088e71620e86cf712292d9e7a29320f26c58b711217722ed9a500484ceea52
SHA512

b331647a46ac34bdd8b5b78de5037558778e70dc31d9eb8ebc8550bdf6665517695d6ddb45f54079423815466c68797edf3f7302555a136972de613160822175

Score

10^/10

Family

redline

Botnet

BBCbrow

C2

qurernenail.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3856-123-0x00000000004171F6-mapping.dmp	family_redline
behavioral2/memory/3856-122-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/3856-130-0x0000000005080000-0x0000000005686000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe

description pid process target process

PID 3744 set thread context of 3856 3744 b5088e71620e86cf712292d9e7a29320f26c58b711217.exe AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 3744 b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Token: SeDebugPrivilege 3856 AddInProcess32.exe

description	pid	process	target process
PID 3744 set thread context of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Token: SeDebugPrivilege	3856	AddInProcess32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe

description	pid	process	target process
PID 3744 wrote to memory of 3740	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3740	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3740	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 3744 wrote to memory of 3856	3744	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
PID:3740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856

memory/3744-114-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3744-116-0x0000000007B50000-0x0000000007B51000-memory.dmp

Filesize
4KB

Download
memory/3744-117-0x0000000007730000-0x0000000007731000-memory.dmp

Filesize
4KB

Download
memory/3744-118-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/3744-119-0x0000000007650000-0x0000000007B4E000-memory.dmp

Filesize
5.0MB

Download
memory/3744-120-0x0000000007AC0000-0x0000000007AD8000-memory.dmp

Filesize
96KB

Download
memory/3744-121-0x0000000008600000-0x0000000008601000-memory.dmp

Filesize
4KB

Download
memory/3856-123-0x00000000004171F6-mapping.dmp

Download
memory/3856-122-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3856-126-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/3856-127-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/3856-128-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3856-129-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/3856-130-0x0000000005080000-0x0000000005686000-memory.dmp

Filesize
6.0MB

Download
memory/3856-131-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download