redline | b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060

General

Target

E2D959B36754B37727EF0C54B11EF3CF.exe
Size

606KB
MD5

e2d959b36754b37727ef0c54b11ef3cf
SHA1

fffc93eec7deeda7d17ab729f89d4c5e01d781cf
SHA256

b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060
SHA512

9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807

Score

10^/10

Family

redline

Botnet

NANani

C2

87.251.71.14:89

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1692-64-0x0000000000418F6E-mapping.dmp	family_redline
behavioral1/memory/1692-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description pid process target process

PID 1100 set thread context of 1692 1100 E2D959B36754B37727EF0C54B11EF3CF.exe E2D959B36754B37727EF0C54B11EF3CF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description pid process

Token: SeDebugPrivilege 1692 E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process	target process
PID 1100 set thread context of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process
Token: SeDebugPrivilege	1692	E2D959B36754B37727EF0C54B11EF3CF.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process	target process
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 1100 wrote to memory of 1692	1100	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe

C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

memory/1100-60-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1100-62-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1692-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1692-64-0x0000000000418F6E-mapping.dmp

Download
memory/1692-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1692-67-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download