redline | 191a6c8951aa3bc73634891e7551a229e15fd90ff0deacef8a2f3a8594d53f6d

General

Target

ea64fb745ef58010d1b9d7ac80f221d0.exe
Size

178KB
MD5

ea64fb745ef58010d1b9d7ac80f221d0
SHA1

7be7c6a48ae96c8d7ef692d03c7405dea60f52a6
SHA256

191a6c8951aa3bc73634891e7551a229e15fd90ff0deacef8a2f3a8594d53f6d
SHA512

2a12518ee29836faecef01cc4660710e90ab81fb3e7080158011ea83f531bc2d0d8bc3ecf4ecb177cdee3ce0570f192628c6137ad98131706c76eb08956e8550

Score

10^/10

redline z0rm1on infostealer

Malware Config

Extracted

Family

redline

Botnet

z0rm1on

C2

185.241.61.33:16195

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2304-123-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral2/memory/2304-124-0x0000000000417326-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

ea64fb745ef58010d1b9d7ac80f221d0.exe

description pid process target process

PID 4056 set thread context of 2304 4056 ea64fb745ef58010d1b9d7ac80f221d0.exe ea64fb745ef58010d1b9d7ac80f221d0.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2016 2304 WerFault.exe ea64fb745ef58010d1b9d7ac80f221d0.exe

description	pid	process	target process
PID 4056 set thread context of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe

pid	pid_target	process	target process
2016	2304	WerFault.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe
2016	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ea64fb745ef58010d1b9d7ac80f221d0.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe
Token: SeRestorePrivilege	2016	WerFault.exe
Token: SeBackupPrivilege	2016	WerFault.exe
Token: SeDebugPrivilege	2016	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ea64fb745ef58010d1b9d7ac80f221d0.exe

description	pid	process	target process
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe
PID 4056 wrote to memory of 2304	4056	ea64fb745ef58010d1b9d7ac80f221d0.exe	ea64fb745ef58010d1b9d7ac80f221d0.exe

C:\Users\Admin\AppData\Local\Temp\ea64fb745ef58010d1b9d7ac80f221d0.exe
"C:\Users\Admin\AppData\Local\Temp\ea64fb745ef58010d1b9d7ac80f221d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056

C:\Users\Admin\AppData\Local\Temp\ea64fb745ef58010d1b9d7ac80f221d0.exe
C:\Users\Admin\AppData\Local\Temp\ea64fb745ef58010d1b9d7ac80f221d0.exe
2⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 160
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-123-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2304-124-0x0000000000417326-mapping.dmp

Download
memory/4056-114-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/4056-116-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/4056-117-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/4056-118-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/4056-119-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/4056-120-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/4056-121-0x00000000052D0000-0x00000000057CE000-memory.dmp

Filesize
5.0MB

Download
memory/4056-122-0x00000000056F0000-0x00000000056F9000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads