redline | 63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab

General

Target

440c6427f359554d5152d93dbb272cc2.exe
Size

416KB
MD5

440c6427f359554d5152d93dbb272cc2
SHA1

1be9b53d33272b3730bf564d1f2b39119cfb7c78
SHA256

63a34871b484152dce8b02ce232207e288049a55ff148d0eee8d7571842d40ab
SHA512

23e14a24c21a89c0222ab2b6a8ae77be7ff788abfa1b1ed3377723ec49d8b0969e84f26142abe564f2eb20ae6986b70f0ba885af394762bae2e383301fd3c2f8

Score

10^/10

Family

redline

Botnet

Teslalogs

C2

91.206.14.151:50125

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1620-61-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1620-66-0x000000000041C5EA-mapping.dmp	family_redline
behavioral1/memory/1620-68-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1620-67-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

440c6427f359554d5152d93dbb272cc2.exe

description pid process target process

PID 1652 set thread context of 1620 1652 440c6427f359554d5152d93dbb272cc2.exe RegSvcs.exe

description	pid	process	target process
PID 1652 set thread context of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

440c6427f359554d5152d93dbb272cc2.exe

description	pid	process	target process
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe
PID 1652 wrote to memory of 1620	1652	440c6427f359554d5152d93dbb272cc2.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1620

memory/1620-61-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1620-66-0x000000000041C5EA-mapping.dmp

Download
memory/1620-68-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1620-67-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1620-69-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1620-71-0x00000000049A0000-0x00000000049A1000-memory.dmp

Filesize
4KB

Download
memory/1652-54-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1652-55-0x0000000001120000-0x0000000001194000-memory.dmp

Filesize
464KB

Download
memory/1652-56-0x0000000074C71000-0x0000000074C73000-memory.dmp

Filesize
8KB

Download
memory/1652-58-0x0000000075E60000-0x0000000075EA7000-memory.dmp

Filesize
284KB

Download
memory/1652-59-0x0000000000420000-0x0000000000463000-memory.dmp

Filesize
268KB

Download
memory/1652-60-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download