redline | d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16

General

Target

32ad2713313dcf30a66402b405278167.exe
Size

481KB
MD5

32ad2713313dcf30a66402b405278167
SHA1

108f4a1cef7ab49cddb8872b945692b34afe4fcf
SHA256

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16
SHA512

cce8e3a6caf2f8fcb3cafc56d1283055eba037886fff7ff3cb80831f5c53a1f238ab78bc7b8155c562561a519ffec7d52d01174923803aeaac09716a15a13081

Score

10^/10

Family

redline

Botnet

01

C2

103.156.90.100:60372

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1956-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1956-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1956-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1956-68-0x000000000041C5D2-mapping.dmp	family_redline
behavioral1/memory/1956-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

32ad2713313dcf30a66402b405278167.exe

description pid process target process

PID 1652 set thread context of 1956 1652 32ad2713313dcf30a66402b405278167.exe 32ad2713313dcf30a66402b405278167.exe

description	pid	process	target process
PID 1652 set thread context of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

32ad2713313dcf30a66402b405278167.exe

description	pid	process	target process
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 1652 wrote to memory of 1956	1652	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
2⤵
PID:1956

memory/1652-0-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/1652-2-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/1956-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-68-0x000000000041C5D2-mapping.dmp

Download
memory/1956-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1956-71-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download