redline | b5088e71620e86cf712292d9e7a29320f26c58b711217722ed9a500484ceea52

General

Target

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Size

708KB
MD5

db874c5199ae1f20b31fc9d419c6da65
SHA1

f670e09bcb0b4e22ca34acccaa73145d23e5113a
SHA256

b5088e71620e86cf712292d9e7a29320f26c58b711217722ed9a500484ceea52
SHA512

b331647a46ac34bdd8b5b78de5037558778e70dc31d9eb8ebc8550bdf6665517695d6ddb45f54079423815466c68797edf3f7302555a136972de613160822175

Score

10^/10

Family

redline

Botnet

BBCbrow

C2

qurernenail.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-63-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1524-64-0x00000000004171F6-mapping.dmp	family_redline
behavioral1/memory/1524-65-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe

description pid process target process

PID 368 set thread context of 1524 368 b5088e71620e86cf712292d9e7a29320f26c58b711217.exe AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 368 b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Token: SeDebugPrivilege 1524 AddInProcess32.exe

description	pid	process	target process
PID 368 set thread context of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe
Token: SeDebugPrivilege	1524	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b5088e71620e86cf712292d9e7a29320f26c58b711217.exe

description	pid	process	target process
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe
PID 368 wrote to memory of 1524	368	b5088e71620e86cf712292d9e7a29320f26c58b711217.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1524

memory/368-59-0x00000000013A0000-0x00000000013A1000-memory.dmp

Filesize
4KB

Download
memory/368-61-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/368-62-0x0000000000890000-0x00000000008A8000-memory.dmp

Filesize
96KB

Download
memory/1524-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1524-64-0x00000000004171F6-mapping.dmp

Download
memory/1524-65-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1524-67-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download