redline | b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060

General

Target

E2D959B36754B37727EF0C54B11EF3CF.exe
Size

606KB
MD5

e2d959b36754b37727ef0c54b11ef3cf
SHA1

fffc93eec7deeda7d17ab729f89d4c5e01d781cf
SHA256

b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060
SHA512

9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807

Score

10^/10

redline nanani infostealer

Malware Config

Extracted

Family

redline

Botnet

NANani

C2

87.251.71.14:89

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2732-120-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/2732-121-0x0000000000418F6E-mapping.dmp	family_redline
behavioral2/memory/2732-129-0x0000000004D80000-0x0000000005386000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description pid process target process

PID 752 set thread context of 2732 752 E2D959B36754B37727EF0C54B11EF3CF.exe E2D959B36754B37727EF0C54B11EF3CF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description pid process

Token: SeDebugPrivilege 2732 E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process	target process
PID 752 set thread context of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process
Token: SeDebugPrivilege	2732	E2D959B36754B37727EF0C54B11EF3CF.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

E2D959B36754B37727EF0C54B11EF3CF.exe

description	pid	process	target process
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe
PID 752 wrote to memory of 2732	752	E2D959B36754B37727EF0C54B11EF3CF.exe	E2D959B36754B37727EF0C54B11EF3CF.exe

C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
"C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E2D959B36754B37727EF0C54B11EF3CF.exe.log
MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
memory/752-114-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/752-116-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/752-117-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/752-118-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/752-119-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/2732-121-0x0000000000418F6E-mapping.dmp

Download
memory/2732-120-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2732-125-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/2732-126-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/2732-127-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/2732-128-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/2732-129-0x0000000004D80000-0x0000000005386000-memory.dmp

Filesize
6.0MB

Download
memory/2732-130-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads