redline | 46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd

General

Target

46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe
Size

656KB
MD5

95029e00a50b60c370c4fcdc60cb0b6d
SHA1

c4d156c2f55fae1cc834e5f0a455d7804dc005eb
SHA256

46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd
SHA512

8fa4ddc75198894f8e6bffef5331b3b98c759cdc6ee60333d66db5084b0b16981d9d7f20ec41c0988152275c33853ab31882648be4ea7f3b332d591ef634ae60

Score

10^/10

Family

redline

Botnet

itit

C2

185.213.211.110:35105

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4484-127-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/4484-128-0x000000000041B23E-mapping.dmp	family_redline
behavioral1/memory/4484-136-0x00000000053B0000-0x00000000059B6000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe

description	pid	process	target process
PID 4344 set thread context of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe

description	pid	process	target process
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe
PID 4344 wrote to memory of 4484	4344	46364afc53eb092dd409e8b31aa2bac984388678baef9154a8dac3d2aee58bfd.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:4484

memory/4344-118-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4344-120-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/4344-121-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/4344-122-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/4344-123-0x0000000004EF0000-0x0000000004EF7000-memory.dmp

Filesize
28KB

Download
memory/4344-124-0x0000000004FB0000-0x00000000054AE000-memory.dmp

Filesize
5.0MB

Download
memory/4344-125-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/4344-126-0x0000000005410000-0x000000000544E000-memory.dmp

Filesize
248KB

Download
memory/4484-127-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4484-128-0x000000000041B23E-mapping.dmp

Download
memory/4484-131-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/4484-132-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/4484-133-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/4484-134-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/4484-135-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4484-136-0x00000000053B0000-0x00000000059B6000-memory.dmp

Filesize
6.0MB

Download