redline | 2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d

General

Target

637862922ea040811a79adf327863e15.exe
Size

388KB
MD5

637862922ea040811a79adf327863e15
SHA1

cd9f3fa9a64e1f1283121c0d02ec4ecde47a4de5
SHA256

2cbe0812081f1c8676e8fb96d9e4e08e6ac092c38982586030bd7302ed2b9a2d
SHA512

b49a749fa554595b5c85ea778de056378555326cdd2c57a7c1e5d2f3e932730a6375f31247d6c8771838c7c791e097b9b83baf09578feb81b0fb3946796e9e29

Score

10^/10

Family

redline

Botnet

18_7_r

C2

xtarweanda.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1172-62-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1172-63-0x0000000000417E1E-mapping.dmp	family_redline
behavioral1/memory/1172-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

637862922ea040811a79adf327863e15.exe

description pid process target process

PID 1996 set thread context of 1172 1996 637862922ea040811a79adf327863e15.exe 637862922ea040811a79adf327863e15.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

637862922ea040811a79adf327863e15.exe

description pid process

Token: SeDebugPrivilege 1172 637862922ea040811a79adf327863e15.exe

description	pid	process	target process
PID 1996 set thread context of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe

description	pid	process
Token: SeDebugPrivilege	1172	637862922ea040811a79adf327863e15.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

637862922ea040811a79adf327863e15.exe

description	pid	process	target process
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe
PID 1996 wrote to memory of 1172	1996	637862922ea040811a79adf327863e15.exe	637862922ea040811a79adf327863e15.exe

C:\Users\Admin\AppData\Local\Temp\637862922ea040811a79adf327863e15.exe
C:\Users\Admin\AppData\Local\Temp\637862922ea040811a79adf327863e15.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

memory/1172-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1172-63-0x0000000000417E1E-mapping.dmp

Download
memory/1172-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1172-66-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1996-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1996-61-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download