redline | 1f608899eb5b861c21365d8409a1f506d7028919d31e36c1002e87573450f12b

Analysis

Target

8D9E3FCF022A280E010848FDF87E154C.exe
Size

303KB
MD5

8d9e3fcf022a280e010848fdf87e154c
SHA1

49c9c74c21d64afc76c90d9139e513efb92a4925
SHA256

1f608899eb5b861c21365d8409a1f506d7028919d31e36c1002e87573450f12b
SHA512

d1c8b1ecb4d5957cecea62fbdbc1147a4693d2f3cf011fe6b8978ec18203c3a79be71fd04a915185cbe6afeeeb8575088aca777be0eb6241254ae70f17ea58cd

Score

10^/10

Family

redline

Botnet

new1

dileyteney.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1820-63-0x0000000002C80000-0x0000000002C9B000-memory.dmp	family_redline
behavioral1/memory/1820-66-0x0000000004520000-0x0000000004539000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8D9E3FCF022A280E010848FDF87E154C.exe

description pid process

Token: SeDebugPrivilege 1820 8D9E3FCF022A280E010848FDF87E154C.exe

description	pid	process
Token: SeDebugPrivilege	1820	8D9E3FCF022A280E010848FDF87E154C.exe

C:\Users\Admin\AppData\Local\Temp\8D9E3FCF022A280E010848FDF87E154C.exe
"C:\Users\Admin\AppData\Local\Temp\8D9E3FCF022A280E010848FDF87E154C.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

memory/1820-60-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1820-61-0x0000000000400000-0x0000000002C10000-memory.dmp

Filesize
40.1MB

Download
memory/1820-62-0x0000000007081000-0x0000000007082000-memory.dmp

Filesize
4KB

Download
memory/1820-63-0x0000000002C80000-0x0000000002C9B000-memory.dmp

Filesize
108KB

Download
memory/1820-64-0x0000000007082000-0x0000000007083000-memory.dmp

Filesize
4KB

Download
memory/1820-65-0x0000000007083000-0x0000000007084000-memory.dmp

Filesize
4KB

Download
memory/1820-66-0x0000000004520000-0x0000000004539000-memory.dmp

Filesize
100KB

Download
memory/1820-67-0x0000000007084000-0x0000000007086000-memory.dmp

Filesize
8KB

Download