redline | d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16

General

Target

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
Size

481KB
MD5

32ad2713313dcf30a66402b405278167
SHA1

108f4a1cef7ab49cddb8872b945692b34afe4fcf
SHA256

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16
SHA512

cce8e3a6caf2f8fcb3cafc56d1283055eba037886fff7ff3cb80831f5c53a1f238ab78bc7b8155c562561a519ffec7d52d01174923803aeaac09716a15a13081

Score

10^/10

redline 01 infostealer

Malware Config

Extracted

Family

redline

Botnet

01

C2

103.156.90.100:60372

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/508-121-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/508-122-0x000000000041C5D2-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

description	pid	process	target process
PID 2492 set thread context of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 508 WerFault.exe d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

pid	pid_target	process	target process
1184	508	WerFault.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

description	pid	process	target process
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
PID 2492 wrote to memory of 508	2492	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe	d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe

C:\Users\Admin\AppData\Local\Temp\d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
"C:\Users\Admin\AppData\Local\Temp\d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492

C:\Users\Admin\AppData\Local\Temp\d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
C:\Users\Admin\AppData\Local\Temp\d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16.exe
2⤵
PID:508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 24
3⤵
- Program crash
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-121-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/508-122-0x000000000041C5D2-mapping.dmp

Download
memory/2492-115-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/2492-117-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/2492-118-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/2492-119-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/2492-120-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads