redline | 7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed

General

Target

88f930ac85e040f29d454a01302b5270.exe
Size

170KB
MD5

88f930ac85e040f29d454a01302b5270
SHA1

237a116a2861efc8662f68828e1a7c2d34cb8047
SHA256

7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed
SHA512

0813ea76d3d78604cb27832a47f1f94f20d4ae1114af35777c9aa5058789ab80e18a5fbe699bc89b689ef00c6c169f98d2c1ea17be27cd83c53e690fde27e209

Score

10^/10

redline agilenet infostealer

Malware Config

Extracted

Family

redline

C2

185.248.101.142:54217

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1332-121-0x0000000000417E8A-mapping.dmp	family_redline
behavioral2/memory/1332-120-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/1332-129-0x00000000056F0000-0x0000000005CF6000-memory.dmp	family_redline

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/904-117-0x0000000004D50000-0x0000000004D58000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe

description pid process target process

PID 904 set thread context of 1332 904 88f930ac85e040f29d454a01302b5270.exe 88f930ac85e040f29d454a01302b5270.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe88f930ac85e040f29d454a01302b5270.exe

description pid process

Token: SeDebugPrivilege 904 88f930ac85e040f29d454a01302b5270.exe
Token: SeDebugPrivilege 1332 88f930ac85e040f29d454a01302b5270.exe

description	pid	process	target process
PID 904 set thread context of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe

description	pid	process
Token: SeDebugPrivilege	904	88f930ac85e040f29d454a01302b5270.exe
Token: SeDebugPrivilege	1332	88f930ac85e040f29d454a01302b5270.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe

description	pid	process	target process
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 904 wrote to memory of 1332	904	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe

C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe
"C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe
C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\88f930ac85e040f29d454a01302b5270.exe.log
MD5
7438b57da35c10c478469635b79e33e1

SHA1
5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

SHA256
b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

SHA512
5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

Download Submit
memory/904-114-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/904-116-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/904-117-0x0000000004D50000-0x0000000004D58000-memory.dmp

Filesize
32KB

Download
memory/904-118-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/904-119-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1332-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1332-121-0x0000000000417E8A-mapping.dmp

Download
memory/1332-125-0x0000000005D00000-0x0000000005D01000-memory.dmp

Filesize
4KB

Download
memory/1332-126-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1332-127-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1332-128-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/1332-129-0x00000000056F0000-0x0000000005CF6000-memory.dmp

Filesize
6.0MB

Download
memory/1332-130-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads