redline | 2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f

Analysis

Target

OLKbrowser.exe
Size

383KB
MD5

8ddd5b9dbcd4e37135868db27b675c2d
SHA1

9122af279871de3f92ac3728e2343950f3e8b995
SHA256

2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f
SHA512

e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f

Score

10^/10

Family

redline

Botnet

AniNEW

akedauiver.xyz:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1216-62-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1216-63-0x0000000000417E1A-mapping.dmp	family_redline
behavioral1/memory/1216-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

redlinestealer 3 IoCs

RedlineStealer.

Processes:

resource	yara_rule
behavioral1/memory/1216-62-0x0000000000400000-0x000000000041E000-memory.dmp	Redline_stealer2
behavioral1/memory/1216-63-0x0000000000417E1A-mapping.dmp	Redline_stealer2
behavioral1/memory/1216-64-0x0000000000400000-0x000000000041E000-memory.dmp	Redline_stealer2

Suspicious use of SetThreadContext 1 IoCs

Processes:

OLKbrowser.exe

description pid process target process

PID 1808 set thread context of 1216 1808 OLKbrowser.exe OLKbrowser.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OLKbrowser.exe

description pid process

Token: SeDebugPrivilege 1216 OLKbrowser.exe

description	pid	process	target process
PID 1808 set thread context of 1216	1808	OLKbrowser.exe	OLKbrowser.exe

description	pid	process
Token: SeDebugPrivilege	1216	OLKbrowser.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

OLKbrowser.exe

description	pid	process	target process
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe
PID 1808 wrote to memory of 1216	1808	OLKbrowser.exe	OLKbrowser.exe

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

memory/1216-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1216-63-0x0000000000417E1A-mapping.dmp

Download
memory/1216-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1216-66-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1808-59-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1808-61-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download