redline | e4331c8eab3a20db74f66603fac6ff6a3faca677176a4015dea2a4665fb3f13f

General

Target

Mopes Hack.exe
Size

326KB
MD5

83e60135c26872fa756fcb26553be6cb
SHA1

3df616b4b4df6faba9373f78dac9a277c07cb26a
SHA256

e4331c8eab3a20db74f66603fac6ff6a3faca677176a4015dea2a4665fb3f13f
SHA512

10834fa839db185629dfce92da2334d4c69dc05041ee045c08610085febeebac054f6c5b64e5a1e259ca06144e6bdc0a91a56acbba130dd6e0aeeb8cfbb67b26

Score

10^/10

redline @silistrii_lzt infostealer

Malware Config

Extracted

Family

redline

Botnet

@silistrii_LZT

C2

arujuyrana.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3364-115-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/3364-120-0x000000000041B246-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1264 created 2404 1264 WerFault.exe Mopes Hack.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Mopes Hack.exe

description pid process target process

PID 2404 set thread context of 3364 2404 Mopes Hack.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1264 2404 WerFault.exe Mopes Hack.exe

description	pid	process	target process
PID 1264 created 2404	1264	WerFault.exe	Mopes Hack.exe

description	pid	process	target process
PID 2404 set thread context of 3364	2404	Mopes Hack.exe	AppLaunch.exe

pid	pid_target	process	target process
1264	2404	WerFault.exe	Mopes Hack.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

WerFault.exe

pid	process
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe
1264	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1264 WerFault.exe
Token: SeBackupPrivilege 1264 WerFault.exe
Token: SeDebugPrivilege 1264 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	1264	WerFault.exe
Token: SeBackupPrivilege	1264	WerFault.exe
Token: SeDebugPrivilege	1264	WerFault.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Mopes Hack.exe

description	pid	process	target process
PID 2404 wrote to memory of 3364	2404	Mopes Hack.exe	AppLaunch.exe
PID 2404 wrote to memory of 3364	2404	Mopes Hack.exe	AppLaunch.exe
PID 2404 wrote to memory of 3364	2404	Mopes Hack.exe	AppLaunch.exe
PID 2404 wrote to memory of 3364	2404	Mopes Hack.exe	AppLaunch.exe
PID 2404 wrote to memory of 3364	2404	Mopes Hack.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\Mopes Hack.exe
"C:\Users\Admin\AppData\Local\Temp\Mopes Hack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 240
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-115-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3364-120-0x000000000041B246-mapping.dmp

Download
memory/3364-121-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3364-122-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3364-123-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/3364-124-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3364-126-0x0000000009360000-0x0000000009361000-memory.dmp

Filesize
4KB

Download
memory/3364-127-0x0000000008DF0000-0x0000000008DF1000-memory.dmp

Filesize
4KB

Download
memory/3364-128-0x0000000008F20000-0x0000000008F21000-memory.dmp

Filesize
4KB

Download
memory/3364-129-0x0000000008E50000-0x0000000008E51000-memory.dmp

Filesize
4KB

Download
memory/3364-130-0x0000000008E90000-0x0000000008E91000-memory.dmp

Filesize
4KB

Download
memory/3364-131-0x0000000008D50000-0x0000000009356000-memory.dmp

Filesize
6.0MB

Download
memory/3364-132-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads