redline | 880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64

General

Target

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe
Size

735KB
MD5

07a7b333916388a9c79677654bd38c58
SHA1

654845924294710677dec0c184dea4f449d34bf9
SHA256

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64
SHA512

6f13f24779c50410bc4fd110f877654be15c4992da7c06b89c475a5d5dab744324bd3ed01a28fb153907d0c72dceeb6f4d5a4d3e0c5cda9ac2d02821c5306f7c

Score

10^/10

redline proliv2 infostealer

Malware Config

Extracted

Family

redline

Botnet

proliv2

C2

95.216.16.35:80

Attributes

auth_value
ca42c778a3f4017ddf8a466bc0b417b1

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3496-114-0x0000000000830000-0x0000000000A6D000-memory.dmp	family_redline
behavioral1/memory/3496-118-0x0000000000830000-0x0000000000A6D000-memory.dmp	family_redline
behavioral1/memory/3496-120-0x0000000000830000-0x0000000000A6D000-memory.dmp	family_redline
behavioral1/memory/3496-121-0x0000000000830000-0x0000000000A6D000-memory.dmp	family_redline

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe

pid process

3496 880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe

pid	process
3496	880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe
3496	880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe

C:\Users\Admin\AppData\Local\Temp\880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe
"C:\Users\Admin\AppData\Local\Temp\880412260564224d36a8407e38a8a58ac19aea2d1133535f8034f7dcf6889f64.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3496-114-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/3496-115-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/3496-116-0x0000000075730000-0x00000000758F2000-memory.dmp

Filesize
1.8MB

Download
memory/3496-117-0x0000000000FF0000-0x0000000001036000-memory.dmp

Filesize
280KB

Download
memory/3496-118-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/3496-119-0x00000000753F0000-0x00000000754E1000-memory.dmp

Filesize
964KB

Download
memory/3496-120-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/3496-121-0x0000000000830000-0x0000000000A6D000-memory.dmp

Filesize
2.2MB

Download
memory/3496-122-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/3496-123-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/3496-124-0x0000000072840000-0x00000000728C0000-memory.dmp

Filesize
512KB

Download
memory/3496-125-0x0000000075BA0000-0x0000000076124000-memory.dmp

Filesize
5.5MB

Download
memory/3496-126-0x0000000076190000-0x00000000774D8000-memory.dmp

Filesize
19.3MB

Download
memory/3496-127-0x0000000005C00000-0x0000000006206000-memory.dmp

Filesize
6.0MB

Download
memory/3496-128-0x0000000005620000-0x0000000005632000-memory.dmp

Filesize
72KB

Download
memory/3496-129-0x0000000005750000-0x000000000585A000-memory.dmp

Filesize
1.0MB

Download
memory/3496-130-0x00000000056B0000-0x00000000056EE000-memory.dmp

Filesize
248KB

Download
memory/3496-131-0x00000000056F0000-0x000000000573B000-memory.dmp

Filesize
300KB

Download
memory/3496-132-0x000000006E2E0000-0x000000006E32B000-memory.dmp

Filesize
300KB

Download
memory/3496-133-0x00000000055F0000-0x0000000005BF6000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing