redline | d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16

General

Target

32ad2713313dcf30a66402b405278167.exe
Size

481KB
MD5

32ad2713313dcf30a66402b405278167
SHA1

108f4a1cef7ab49cddb8872b945692b34afe4fcf
SHA256

d9954ff3216b822c0d2ed2355bfa7203704d5a921052bd4d5b38644e31441c16
SHA512

cce8e3a6caf2f8fcb3cafc56d1283055eba037886fff7ff3cb80831f5c53a1f238ab78bc7b8155c562561a519ffec7d52d01174923803aeaac09716a15a13081

Score

10^/10

redline 01 infostealer

Malware Config

Extracted

Family

redline

Botnet

01

C2

103.156.90.100:60372

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3256-120-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/3256-121-0x000000000041C5D2-mapping.dmp	family_redline
behavioral2/memory/3256-128-0x0000000005740000-0x0000000005D46000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

32ad2713313dcf30a66402b405278167.exe

description pid process target process

PID 656 set thread context of 3256 656 32ad2713313dcf30a66402b405278167.exe 32ad2713313dcf30a66402b405278167.exe

description	pid	process	target process
PID 656 set thread context of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

32ad2713313dcf30a66402b405278167.exe

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
"C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
2⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
2⤵
PID:392

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
2⤵
PID:2356

C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
C:\Users\Admin\AppData\Local\Temp\32ad2713313dcf30a66402b405278167.exe
2⤵
PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-114-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/656-116-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/656-117-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/656-118-0x0000000002D40000-0x0000000002DB6000-memory.dmp

Filesize
472KB

Download
memory/656-119-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/3256-120-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3256-121-0x000000000041C5D2-mapping.dmp

Download
memory/3256-124-0x0000000005D50000-0x0000000005D51000-memory.dmp

Filesize
4KB

Download
memory/3256-125-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/3256-126-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download
memory/3256-127-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/3256-128-0x0000000005740000-0x0000000005D46000-memory.dmp

Filesize
6.0MB

Download
memory/3256-129-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 656 wrote to memory of 2624	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 2624	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 2624	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 392	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 392	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 392	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 2356	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 2356	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 2356	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe
PID 656 wrote to memory of 3256	656	32ad2713313dcf30a66402b405278167.exe	32ad2713313dcf30a66402b405278167.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads