redline | 610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3

General

Target

610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe
Size

715KB
MD5

4da64a00d7ff89c04d675f50c32ee458
SHA1

505f39f4039bf5cba0009ea7b7d856f57d31a592
SHA256

610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3
SHA512

d38b6c1aea8763bdfc4e5cbaab8d65a74cf3bdf4d4230efc7005416a58f83742df46b213b91a83967aeb6d9dfccaa038adbf6001569e520b26373fa8f00ab9f4

Score

10^/10

Family

redline

Botnet

new1

C2

185.180.220.105:11915

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1316-57-0x0000000000090000-0x00000000000E6000-memory.dmp	family_redline
behavioral1/memory/1316-62-0x0000000000090000-0x00000000000E6000-memory.dmp	family_redline
behavioral1/memory/1316-63-0x0000000000090000-0x00000000000E6000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe

description	pid	process	target process
PID 1636 set thread context of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe

description	pid	process	target process
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe
PID 1636 wrote to memory of 1316	1636	610c668380bad93964320bea5957b4c08861e277abc78230a770ad45194905b3.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1316

memory/1316-56-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/1316-57-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/1316-62-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/1316-63-0x0000000000090000-0x00000000000E6000-memory.dmp

Filesize
344KB

Download
memory/1316-64-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/1316-65-0x00000000010E0000-0x00000000010E1000-memory.dmp

Filesize
4KB

Download
memory/1636-55-0x00000000002FF000-0x0000000000300000-memory.dmp

Filesize
4KB

Download