redline | c25e427b4cc4f925eb98334fd1795f2e3dc09eaf4df8cf1342dbca9ae33e18f9

General

Target

72b06da5e2d23ee12b89d891e80bda5f.exe
Size

487KB
MD5

72b06da5e2d23ee12b89d891e80bda5f
SHA1

1e31ab5828fa44e161060d64a37dedcac6909b2b
SHA256

c25e427b4cc4f925eb98334fd1795f2e3dc09eaf4df8cf1342dbca9ae33e18f9
SHA512

1c0e8761f814ae511b962b45e9136e095c6ef1113c6e02ac17b5fdba0186d5b2b1c93f24554eb8ba00b6394b92f8f1153e4fe58f868e29d5cd6a4a98acf62d90

Score

10^/10

Family

redline

Botnet

new1

C2

78.47.178.190:24520

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1808-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1808-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1808-61-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1808-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

72b06da5e2d23ee12b89d891e80bda5f.exe

description pid process target process

PID 1668 set thread context of 1808 1668 72b06da5e2d23ee12b89d891e80bda5f.exe 72b06da5e2d23ee12b89d891e80bda5f.exe

description	pid	process	target process
PID 1668 set thread context of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

72b06da5e2d23ee12b89d891e80bda5f.exe

description	pid	process	target process
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe
PID 1668 wrote to memory of 1808	1668	72b06da5e2d23ee12b89d891e80bda5f.exe	72b06da5e2d23ee12b89d891e80bda5f.exe

C:\Users\Admin\AppData\Local\Temp\72b06da5e2d23ee12b89d891e80bda5f.exe
C:\Users\Admin\AppData\Local\Temp\72b06da5e2d23ee12b89d891e80bda5f.exe
2⤵
PID:1808

memory/1668-54-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

Filesize
4KB

Download
memory/1668-55-0x0000000000020000-0x00000000000A0000-memory.dmp

Filesize
512KB

Download
memory/1668-56-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/1808-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1808-63-0x0000000073EBE000-0x0000000073EBF000-memory.dmp

Filesize
4KB

Download
memory/1808-64-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download