redline | 2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f

General

Target

OLKbrowser.exe
Size

383KB
MD5

8ddd5b9dbcd4e37135868db27b675c2d
SHA1

9122af279871de3f92ac3728e2343950f3e8b995
SHA256

2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f
SHA512

e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f

Score

10^/10

redline aninew infostealer stealer

Malware Config

Extracted

Family

redline

Botnet

AniNEW

C2

akedauiver.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2284-119-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/2284-120-0x0000000000417E1A-mapping.dmp	family_redline
behavioral2/memory/2284-128-0x0000000005490000-0x0000000005A96000-memory.dmp	family_redline

redlinestealer 2 IoCs

RedlineStealer.

stealer

Processes:

resource	yara_rule
behavioral2/memory/2284-119-0x0000000000400000-0x000000000041E000-memory.dmp	Redline_stealer2
behavioral2/memory/2284-120-0x0000000000417E1A-mapping.dmp	Redline_stealer2

Suspicious use of SetThreadContext 1 IoCs

Processes:

OLKbrowser.exe

description pid process target process

PID 804 set thread context of 2284 804 OLKbrowser.exe OLKbrowser.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

OLKbrowser.exe

description pid process

Token: SeDebugPrivilege 2284 OLKbrowser.exe

description	pid	process	target process
PID 804 set thread context of 2284	804	OLKbrowser.exe	OLKbrowser.exe

description	pid	process
Token: SeDebugPrivilege	2284	OLKbrowser.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

OLKbrowser.exe

description	pid	process	target process
PID 804 wrote to memory of 3216	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 3216	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 3216	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2360	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2360	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2360	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe
PID 804 wrote to memory of 2284	804	OLKbrowser.exe	OLKbrowser.exe

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
2⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
2⤵
PID:2360

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OLKbrowser.exe.log
MD5
7438b57da35c10c478469635b79e33e1

SHA1
5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

SHA256
b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

SHA512
5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

Download Submit
memory/804-118-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/804-117-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/804-116-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/2284-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2284-120-0x0000000000417E1A-mapping.dmp

Download
memory/2284-124-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/2284-125-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/2284-126-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/2284-127-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/2284-128-0x0000000005490000-0x0000000005A96000-memory.dmp

Filesize
6.0MB

Download
memory/2284-129-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads