redline | a9db37183a4d7898d4ef820075d9fb5cdef55b47644cc5465b5e012c9a52b2fe

Resubmissions

08-07-2021 11:17

08-07-2021 11:17

Target

0x00030000000130e1-156.exe
Size

380KB
MD5

b0486bfc2e579b49b0cacee12c52469c
SHA1

ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA256

9057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512

b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075

Score

10^/10

Family

redline

Botnet

ServAni

87.251.71.195:82

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral12/memory/4048-117-0x0000000000417F26-mapping.dmp	family_redline
behavioral12/memory/4048-116-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

0x00030000000130e1-156.exe

description pid process target process

PID 3896 set thread context of 4048 3896 0x00030000000130e1-156.exe 0x00030000000130e1-156.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0x00030000000130e1-156.exe

description pid process

Token: SeDebugPrivilege 4048 0x00030000000130e1-156.exe

description	pid	process	target process
PID 3896 set thread context of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe

description	pid	process
Token: SeDebugPrivilege	4048	0x00030000000130e1-156.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

0x00030000000130e1-156.exe

description	pid	process	target process
PID 3896 wrote to memory of 2088	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 2088	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 2088	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe
PID 3896 wrote to memory of 4048	3896	0x00030000000130e1-156.exe	0x00030000000130e1-156.exe

C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
2⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
C:\Users\Admin\AppData\Local\Temp\0x00030000000130e1-156.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0x00030000000130e1-156.exe.log
MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
memory/3896-114-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/4048-117-0x0000000000417F26-mapping.dmp

Download
memory/4048-116-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4048-121-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/4048-122-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/4048-123-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/4048-124-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/4048-125-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/4048-126-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download