redline | 6c2fc47191c17a3bef2060481ca8c058336ad27c731b245212364c132081fc2a

General

Target

be5006a529a06f16a268bdb477d8878b.exe
Size

431KB
MD5

be5006a529a06f16a268bdb477d8878b
SHA1

7763f470338bf5556cd3f23c3ecababfcd5dd9b1
SHA256

6c2fc47191c17a3bef2060481ca8c058336ad27c731b245212364c132081fc2a
SHA512

1a80b6018c4ff565d3af3c76eca56fa0aa68cebcdb2affc2793dbdfc8d779a90aaf7f79b25b4b8f1918b4e2f43eb7dd47ad30e4ef06dc7126e26831b34cf9cd4

Score

10^/10

Family

redline

Botnet

felix2009

C2

213.166.69.181:64650

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1704-57-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1704-58-0x000000000041C5E2-mapping.dmp	family_redline
behavioral1/memory/1704-59-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

be5006a529a06f16a268bdb477d8878b.exe

description pid process target process

PID 840 set thread context of 1704 840 be5006a529a06f16a268bdb477d8878b.exe be5006a529a06f16a268bdb477d8878b.exe

description	pid	process	target process
PID 840 set thread context of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

be5006a529a06f16a268bdb477d8878b.exe

description	pid	process	target process
PID 840 wrote to memory of 1612	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1612	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1612	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1612	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe
PID 840 wrote to memory of 1704	840	be5006a529a06f16a268bdb477d8878b.exe	be5006a529a06f16a268bdb477d8878b.exe

C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe
C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe
2⤵
PID:1612

C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe
C:\Users\Admin\AppData\Local\Temp\be5006a529a06f16a268bdb477d8878b.exe
2⤵
PID:1704

memory/840-54-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/840-56-0x0000000004480000-0x0000000004481000-memory.dmp

Filesize
4KB

Download
memory/1704-57-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1704-58-0x000000000041C5E2-mapping.dmp

Download
memory/1704-59-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1704-61-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download