redline | f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1

General

Target

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
Size

378KB
MD5

988a04b95560cf988b7cfa0daa3089ae
SHA1

fd19469731f19ca0d7ea13c13f9a8ad4c22c0bde
SHA256

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1
SHA512

e6c0207d708a985c7cd152a7712f69a607cd31b94a937d01fcf3c8087f8436ddcb011dac3704a0cfa0a41f80b807b93b4cbdf11cebfc02270e6d307ff6dadf29

Score

10^/10

redline 121212 infostealer

Malware Config

Extracted

Family

redline

Botnet

121212

C2

168.119.241.77:60932

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1600-123-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/1600-124-0x000000000041639E-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process	procid_target
PID 1844 set thread context of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exef38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process
Token: SeDebugPrivilege	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
Token: SeDebugPrivilege	1600	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe

description	pid	Process	procid_target
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79
PID 1844 wrote to memory of 1600	1844	f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe	79

C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
"C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
  C:\Users\Admin\AppData\Local\Temp\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf.exe.log

MD5
4a30a8132195c1aa1a62b78676b178d9

SHA1
506e6d99a2ba08c9d3553af30daaaa0fc46ae4be

SHA256
71636c227625058652c089035480b7bb3e5795f3998bc9823c401029fc844a20

SHA512
3272b5129525c2b8f7efb99f5a2115cf2572480ff6938ca80e63f02c52588216f861307b9ef962ba015787cae0d5a95e74ebb5fe4b35b34f1c4f3a7deac8ce09

Download Submit
memory/1600-131-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1600-129-0x0000000006010000-0x0000000006011000-memory.dmp

Filesize
4KB

Download
memory/1600-134-0x0000000005000000-0x00000000054FE000-memory.dmp

Filesize
5.0MB

Download
memory/1600-135-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/1600-124-0x000000000041639E-mapping.dmp

Download
memory/1600-133-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/1600-132-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/1600-123-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1844-120-0x00000000074C0000-0x00000000074C1000-memory.dmp

Filesize
4KB

Download
memory/1844-116-0x0000000007700000-0x0000000007701000-memory.dmp

Filesize
4KB

Download
memory/1844-122-0x0000000007C70000-0x0000000007C77000-memory.dmp

Filesize
28KB

Download
memory/1844-114-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1844-117-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/1844-121-0x0000000007C20000-0x0000000007C21000-memory.dmp

Filesize
4KB

Download
memory/1844-119-0x0000000007200000-0x00000000076FE000-memory.dmp

Filesize
5.0MB

Download
memory/1844-118-0x0000000007250000-0x0000000007251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads