redline | 9a683ec03220d633a7cce5da8a6d7c9febe608eb45e572691e12600a2d6d58f0

General

Target

9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
Size

888KB
MD5

57179b3e7c3f753a918ab68ec2ba5af4
SHA1

aa542ee29b078b3ae446b2021dce6b5fc690accd
SHA256

9a683ec03220d633a7cce5da8a6d7c9febe608eb45e572691e12600a2d6d58f0
SHA512

c4f9bcde5cda179371432c96e132581edd2e0d9a550893d891a0d207533b87a245a75cc29c1cfb585d7e866f6bbe2dfa8d050a366d960b9205088af38b6907fd

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1628-64-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1628-65-0x00000000004163C2-mapping.dmp	family_redline
behavioral1/memory/1628-66-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

description	pid	process	target process
PID 108 set thread context of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

description pid process

Token: SeDebugPrivilege 1628 9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

description	pid	process
Token: SeDebugPrivilege	1628	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

description	pid	process	target process
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
PID 108 wrote to memory of 1628	108	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe	9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe

C:\Users\Admin\AppData\Local\Temp\9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe
"C:\Users\Admin\AppData\Local\Temp\9a683ec03220d633a7cce5da8a6d7c9febe608eb45e57.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

memory/108-60-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/108-62-0x0000000000260000-0x0000000000280000-memory.dmp

Filesize
128KB

Download
memory/108-63-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/1628-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1628-65-0x00000000004163C2-mapping.dmp

Download
memory/1628-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1628-68-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download