redline | be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8

Analysis

Target

be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe
Size

401KB
MD5

a9fa01f0aa6c18a5520e918303a91a10
SHA1

3f5ef40bfb1181c2944e8fa4ff44215c0831789c
SHA256

be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8
SHA512

b008c6532ca8e93fc379b21aec4939133dfa1b289f4876a50d3c9f456d0391177ab5f4445cf642dc184eb0bd959e739a6d697950427077be914acbb5cf644ffc

Score

10^/10

Family

redline

Botnet

Pablicher

45.9.20.247:11452

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-54-0x0000000001ED0000-0x0000000001F04000-memory.dmp	family_redline
behavioral1/memory/1684-55-0x0000000002090000-0x00000000020C2000-memory.dmp	family_redline

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe

description pid process

Token: SeDebugPrivilege 1684 be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe

description	pid	process
Token: SeDebugPrivilege	1684	be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe

C:\Users\Admin\AppData\Local\Temp\be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe
"C:\Users\Admin\AppData\Local\Temp\be336ff807ecd120dca270ee1fae0b2284d2d112d6f1ed9baa875824146befa8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

memory/1684-53-0x00000000006DB000-0x0000000000707000-memory.dmp

Filesize
176KB

Download
memory/1684-54-0x0000000001ED0000-0x0000000001F04000-memory.dmp

Filesize
208KB

Download
memory/1684-55-0x0000000002090000-0x00000000020C2000-memory.dmp

Filesize
200KB

Download
memory/1684-56-0x00000000006DB000-0x0000000000707000-memory.dmp

Filesize
176KB

Download
memory/1684-57-0x0000000000220000-0x0000000000259000-memory.dmp

Filesize
228KB

Download
memory/1684-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-59-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Filesize
4KB

Download
memory/1684-60-0x0000000004891000-0x0000000004892000-memory.dmp

Filesize
4KB

Download
memory/1684-62-0x0000000004893000-0x0000000004894000-memory.dmp

Filesize
4KB

Download
memory/1684-61-0x0000000004892000-0x0000000004893000-memory.dmp

Filesize
4KB

Download
memory/1684-63-0x0000000004894000-0x0000000004896000-memory.dmp

Filesize
8KB

Download