redline | f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1

General

Target

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
Size

378KB
MD5

988a04b95560cf988b7cfa0daa3089ae
SHA1

fd19469731f19ca0d7ea13c13f9a8ad4c22c0bde
SHA256

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1
SHA512

e6c0207d708a985c7cd152a7712f69a607cd31b94a937d01fcf3c8087f8436ddcb011dac3704a0cfa0a41f80b807b93b4cbdf11cebfc02270e6d307ff6dadf29

Score

10^/10

redline 121212 infostealer

Malware Config

Extracted

Family

redline

Botnet

121212

C2

168.119.241.77:60932

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-65-0x000000000041639E-mapping.dmp	family_redline
behavioral1/memory/1668-64-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1668-66-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process	procid_target
PID 1084 set thread context of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exef38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process
Token: SeDebugPrivilege	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
Token: SeDebugPrivilege	1668	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process	procid_target
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29
PID 1084 wrote to memory of 1668	1084	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	29

C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
"C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
  C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1084-60-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/1084-62-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/1084-63-0x0000000000700000-0x0000000000707000-memory.dmp

Filesize
28KB

Download
memory/1668-65-0x000000000041639E-mapping.dmp

Download
memory/1668-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1668-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1668-68-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads