redline | 8b013095eac15ef06fd67f6c2f101dfe14c04a33a10d63e278ee5d506c862910

Analysis

Target

TELEGR~1.EXE
Size

556KB
MD5

54db9520f3db0b612c492cd14b689b98
SHA1

cacba09c6883605d3918626c4a92cc4cb846bcda
SHA256

8b013095eac15ef06fd67f6c2f101dfe14c04a33a10d63e278ee5d506c862910
SHA512

3cf6bd666d66ac95ed4b601ac0990839edac41f12786b8201778930daf42a72d53768c0eabaf84357e5741e10b9e4bbd0a219773e31791df863e7d8a3a7d584e

Score

10^/10

Family

redline

Botnet

Build1

45.142.213.135:30058

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1688-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1688-64-0x0000000000417E9A-mapping.dmp	family_redline
behavioral1/memory/1688-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

TELEGR~1.EXE

description pid process target process

PID 856 set thread context of 1688 856 TELEGR~1.EXE TELEGR~1.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TELEGR~1.EXE

description pid process

Token: SeDebugPrivilege 1688 TELEGR~1.EXE

description	pid	process	target process
PID 856 set thread context of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE

description	pid	process
Token: SeDebugPrivilege	1688	TELEGR~1.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

TELEGR~1.EXE

description	pid	process	target process
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE
PID 856 wrote to memory of 1688	856	TELEGR~1.EXE	TELEGR~1.EXE

C:\Users\Admin\AppData\Local\Temp\TELEGR~1.EXE
C:\Users\Admin\AppData\Local\Temp\TELEGR~1.EXE
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

memory/856-60-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/856-62-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1688-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1688-64-0x0000000000417E9A-mapping.dmp

Download
memory/1688-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1688-67-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download