redline | 828db99b2939fbdc9397cea77ee15a611198f643a9e2a636226817d753e39806

General

Target

941e3c8549aeb8a5ad817c084688595f.exe
Size

609KB
MD5

941e3c8549aeb8a5ad817c084688595f
SHA1

027613c16b6291635039f2ebd6f04a71daf66715
SHA256

828db99b2939fbdc9397cea77ee15a611198f643a9e2a636226817d753e39806
SHA512

3b9f8577a11ea6eeb6bacd1d457506fa44f6b1b80bb8b936d3f3eecf5fd00ef4f9e46defff1f23ddd51d1725e0df541fecfa58b5c5e9a0903a758f46952af1c7

Score

10^/10

Family

redline

C2

193.38.55.96:53888

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1492-63-0x0000000000400000-0x0000000000478000-memory.dmp	family_redline
behavioral1/memory/1492-64-0x0000000000417EC6-mapping.dmp	family_redline
behavioral1/memory/1492-65-0x0000000000400000-0x0000000000478000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

941e3c8549aeb8a5ad817c084688595f.exe

description pid process target process

PID 484 set thread context of 1492 484 941e3c8549aeb8a5ad817c084688595f.exe 941e3c8549aeb8a5ad817c084688595f.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

941e3c8549aeb8a5ad817c084688595f.exe941e3c8549aeb8a5ad817c084688595f.exe

description pid process

Token: SeDebugPrivilege 484 941e3c8549aeb8a5ad817c084688595f.exe
Token: SeDebugPrivilege 1492 941e3c8549aeb8a5ad817c084688595f.exe

description	pid	process	target process
PID 484 set thread context of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe

description	pid	process
Token: SeDebugPrivilege	484	941e3c8549aeb8a5ad817c084688595f.exe
Token: SeDebugPrivilege	1492	941e3c8549aeb8a5ad817c084688595f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

941e3c8549aeb8a5ad817c084688595f.exe

description	pid	process	target process
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe
PID 484 wrote to memory of 1492	484	941e3c8549aeb8a5ad817c084688595f.exe	941e3c8549aeb8a5ad817c084688595f.exe

C:\Users\Admin\AppData\Local\Temp\941e3c8549aeb8a5ad817c084688595f.exe
C:\Users\Admin\AppData\Local\Temp\941e3c8549aeb8a5ad817c084688595f.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1492

memory/484-59-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/484-61-0x0000000004780000-0x0000000004781000-memory.dmp

Filesize
4KB

Download
memory/484-62-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/1492-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1492-64-0x0000000000417EC6-mapping.dmp

Download
memory/1492-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1492-67-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download