redline | 14d3995a5466c357fff817ac63a96da2f34c59453e1cbc28ba0315aef1c43cf8

General

Target

DMVideo.exe
Size

353KB
MD5

592c1cc435037d3cdc583e4b9ba1eec2
SHA1

7327e12960157f0a1077ae23193f4848398da801
SHA256

14d3995a5466c357fff817ac63a96da2f34c59453e1cbc28ba0315aef1c43cf8
SHA512

617da76d6e42e3e18d1f01e1af24bccc47cff08e7d09b6bc25d8d9642f5ab36c50cef461b431a1fe38d8846a54faa278e8f6e106a103b55f1cf46587dd9e7e3a

Score

10^/10

redline magsik infostealer

Malware Config

Extracted

Family

redline

Botnet

magsik

C2

185.215.113.45:3722

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1476-124-0x0000000000416082-mapping.dmp	family_redline
behavioral2/memory/1476-123-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

DMVideo.exe

description pid process target process

PID 4436 set thread context of 1476 4436 DMVideo.exe DMVideo.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4116 1476 WerFault.exe DMVideo.exe

description	pid	process	target process
PID 4436 set thread context of 1476	4436	DMVideo.exe	DMVideo.exe

pid	pid_target	process	target process
4116	1476	WerFault.exe	DMVideo.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe
4116	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

DMVideo.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4436	DMVideo.exe
Token: SeRestorePrivilege	4116	WerFault.exe
Token: SeBackupPrivilege	4116	WerFault.exe
Token: SeDebugPrivilege	4116	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

DMVideo.exe

description	pid	process	target process
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe
PID 4436 wrote to memory of 1476	4436	DMVideo.exe	DMVideo.exe

C:\Users\Admin\AppData\Local\Temp\DMVideo.exe
"C:\Users\Admin\AppData\Local\Temp\DMVideo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\DMVideo.exe
  C:\Users\Admin\AppData\Local\Temp\DMVideo.exe
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 160
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-124-0x0000000000416082-mapping.dmp

Download
memory/1476-123-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4436-114-0x0000000000A40000-0x0000000000A41000-memory.dmp

Filesize
4KB

Download
memory/4436-116-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/4436-117-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/4436-118-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/4436-119-0x0000000005410000-0x000000000590E000-memory.dmp

Filesize
5.0MB

Download
memory/4436-120-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/4436-121-0x0000000005E10000-0x0000000005E11000-memory.dmp

Filesize
4KB

Download
memory/4436-122-0x0000000005E70000-0x0000000005E77000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads