redline | f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

Analysis

Target

NAN.exe
Size

608KB
MD5

db1e5d0455f39c5cf5ac0c210dd679c4
SHA1

836e95bd1285ff790e55a8602febb29d97187bd7
SHA256

578eddcbe98744e25e8836b7cdc447f62b7032bcd3d083f2eb0cfe018022243e
SHA512

3f349ba618510f3e76e893fb70f0bfd5c3885216d73ed024617b49878eed376789eb7d3e4d347bb84aec8d90dbd0706256cdfdfa3f99c3b2b62982d9bc5c3a25

Score

10^/10

Family

redline

Botnet

NANani

87.251.71.14:89

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral10/memory/1212-120-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral10/memory/1212-121-0x000000000041A68A-mapping.dmp	family_redline
behavioral10/memory/1212-127-0x00000000051D0000-0x00000000057D6000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

NAN.exe

description pid process target process

PID 992 set thread context of 1212 992 NAN.exe NAN.exe

description	pid	process	target process
PID 992 set thread context of 1212	992	NAN.exe	NAN.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NAN.exe

description	pid	process	target process
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe
PID 992 wrote to memory of 1212	992	NAN.exe	NAN.exe

C:\Users\Admin\AppData\Local\Temp\NAN.exe
"C:\Users\Admin\AppData\Local\Temp\NAN.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\NAN.exe
  C:\Users\Admin\AppData\Local\Temp\NAN.exe
  2⤵
  PID:1212

memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/992-116-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/992-117-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/992-118-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/992-119-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/1212-120-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1212-121-0x000000000041A68A-mapping.dmp

Download
memory/1212-124-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/1212-125-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/1212-126-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/1212-127-0x00000000051D0000-0x00000000057D6000-memory.dmp

Filesize
6.0MB

Download
memory/1212-128-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/1212-129-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download