redline | 3bec59f84c4d86172ce1bfdd8d2f43ab1e679155620852c13f44cfe5cd95a0fd

Analysis

Target

51cb4383518e4d2ca519ab6c8874fc4c.exe
Size

358KB
MD5

51cb4383518e4d2ca519ab6c8874fc4c
SHA1

e8875494406aa10c347edea47fa8e607194023e3
SHA256

3bec59f84c4d86172ce1bfdd8d2f43ab1e679155620852c13f44cfe5cd95a0fd
SHA512

11490c1e5ca5da171204709adf1cb6cd23b4c3cee8f437147b8ebf5d7f07e24bf3e7611359cce68b1270f36ebc8e2bf2f92de38648dcef2ea9d5acddb79f9927

Score

10^/10

Family

redline

Botnet

Kolya

195.201.17.219:25524

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/792-61-0x0000000000610000-0x000000000062A000-memory.dmp	family_redline
behavioral1/memory/792-62-0x0000000001E50000-0x0000000001E69000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

51cb4383518e4d2ca519ab6c8874fc4c.exe

description pid process

Token: SeDebugPrivilege 792 51cb4383518e4d2ca519ab6c8874fc4c.exe

description	pid	process
Token: SeDebugPrivilege	792	51cb4383518e4d2ca519ab6c8874fc4c.exe

C:\Users\Admin\AppData\Local\Temp\51cb4383518e4d2ca519ab6c8874fc4c.exe
"C:\Users\Admin\AppData\Local\Temp\51cb4383518e4d2ca519ab6c8874fc4c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:792

memory/792-59-0x0000000000230000-0x000000000025F000-memory.dmp

Filesize
188KB

Download
memory/792-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/792-61-0x0000000000610000-0x000000000062A000-memory.dmp

Filesize
104KB

Download
memory/792-62-0x0000000001E50000-0x0000000001E69000-memory.dmp

Filesize
100KB

Download
memory/792-65-0x00000000048A3000-0x00000000048A4000-memory.dmp

Filesize
4KB

Download
memory/792-64-0x00000000048A2000-0x00000000048A3000-memory.dmp

Filesize
4KB

Download
memory/792-63-0x00000000048A1000-0x00000000048A2000-memory.dmp

Filesize
4KB

Download
memory/792-66-0x00000000048A4000-0x00000000048A6000-memory.dmp

Filesize
8KB

Download