redline | 7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed

General

Target

88f930ac85e040f29d454a01302b5270.exe
Size

170KB
MD5

88f930ac85e040f29d454a01302b5270
SHA1

237a116a2861efc8662f68828e1a7c2d34cb8047
SHA256

7a07416a0737540a9f0049d6c1094c4986e90d46561ed583f597ca4f01a3eaed
SHA512

0813ea76d3d78604cb27832a47f1f94f20d4ae1114af35777c9aa5058789ab80e18a5fbe699bc89b689ef00c6c169f98d2c1ea17be27cd83c53e690fde27e209

Score

10^/10

Family

redline

C2

185.248.101.142:54217

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1680-62-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1680-63-0x0000000000417E8A-mapping.dmp	family_redline
behavioral1/memory/1680-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

Processes:

resource	yara_rule
behavioral1/memory/1996-61-0x0000000000300000-0x0000000000308000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe

description pid process target process

PID 1996 set thread context of 1680 1996 88f930ac85e040f29d454a01302b5270.exe 88f930ac85e040f29d454a01302b5270.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe88f930ac85e040f29d454a01302b5270.exe

description pid process

Token: SeDebugPrivilege 1996 88f930ac85e040f29d454a01302b5270.exe
Token: SeDebugPrivilege 1680 88f930ac85e040f29d454a01302b5270.exe

description	pid	process	target process
PID 1996 set thread context of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe

description	pid	process
Token: SeDebugPrivilege	1996	88f930ac85e040f29d454a01302b5270.exe
Token: SeDebugPrivilege	1680	88f930ac85e040f29d454a01302b5270.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

88f930ac85e040f29d454a01302b5270.exe

description	pid	process	target process
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe
PID 1996 wrote to memory of 1680	1996	88f930ac85e040f29d454a01302b5270.exe	88f930ac85e040f29d454a01302b5270.exe

C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe
C:\Users\Admin\AppData\Local\Temp\88f930ac85e040f29d454a01302b5270.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

memory/1680-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1680-63-0x0000000000417E8A-mapping.dmp

Download
memory/1680-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1680-67-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/1996-59-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/1996-61-0x0000000000300000-0x0000000000308000-memory.dmp

Filesize
32KB

Download
memory/1996-66-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download