redline | fbc24a9119f2484a25026cb05cb52d1377b88bda8d6aef13cf32714680c13ade

Analysis

Target

slot7.exe
Size

104KB
MD5

abe3eeb6a37d82e725b86e3120e584eb
SHA1

8df2701e65b17601de19c3a18c6c55f96784d97d
SHA256

fbc24a9119f2484a25026cb05cb52d1377b88bda8d6aef13cf32714680c13ade
SHA512

b22819bff2102078315766fdf1d0827e1754619169ff592a13932ea658e8bfebfeadc09971197562dbf6f3d4efe0a455e0cc49b2b939d2a3a8c503a47c50922b

Score

10^/10

Family

redline

Botnet

195.2.79.72:13533

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5052-130-0x0000000000320000-0x0000000000340000-memory.dmp	family_redline

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	4488	svchost.exe
Token: SeCreatePagefilePrivilege	4488	svchost.exe
Token: SeShutdownPrivilege	4488	svchost.exe
Token: SeCreatePagefilePrivilege	4488	svchost.exe
Token: SeShutdownPrivilege	4488	svchost.exe
Token: SeCreatePagefilePrivilege	4488	svchost.exe

C:\Users\Admin\AppData\Local\Temp\slot7.exe
"C:\Users\Admin\AppData\Local\Temp\slot7.exe"
1⤵
PID:5052

memory/4488-137-0x0000016D82970000-0x0000016D82980000-memory.dmp

Filesize
64KB

Download
memory/4488-138-0x0000016D82F20000-0x0000016D82F30000-memory.dmp

Filesize
64KB

Download
memory/4488-139-0x0000016D855F0000-0x0000016D855F4000-memory.dmp

Filesize
16KB

Download
memory/5052-130-0x0000000000320000-0x0000000000340000-memory.dmp

Filesize
128KB

Download
memory/5052-131-0x00000000051C0000-0x00000000057D8000-memory.dmp

Filesize
6.1MB

Download
memory/5052-132-0x0000000002710000-0x0000000002722000-memory.dmp

Filesize
72KB

Download
memory/5052-133-0x0000000004CB0000-0x0000000004DBA000-memory.dmp

Filesize
1.0MB

Download
memory/5052-134-0x000000007506E000-0x000000007506F000-memory.dmp

Filesize
4KB

Download
memory/5052-135-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/5052-136-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download