redline | e5c444885808b5fcb13c40fb5d6c12013462113793988bf805c3b9f3b7f56ffb

Analysis

Target

72fe3a6f7ec7918ba7d09002d44f7e8a.exe
Size

467KB
MD5

72fe3a6f7ec7918ba7d09002d44f7e8a
SHA1

8313d2104e587fd5e14d1682f005ef17a01ec7a9
SHA256

e5c444885808b5fcb13c40fb5d6c12013462113793988bf805c3b9f3b7f56ffb
SHA512

0802b8a9a9bdaa4e7cc60bd28f10ce754f3c08fac353879df2c3218aa8ba4f1e3c12c4fb528531752f463b95203cc21145b1408b2a82dc98da64210dc591ebdb

Score

10^/10

Family

redline

Botnet

portall

vistolham.xyz:81

dussicora.xyz:81

morrwlerh.xyz:81

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/208-138-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

72fe3a6f7ec7918ba7d09002d44f7e8a.exe

description pid process target process

PID 4200 set thread context of 208 4200 72fe3a6f7ec7918ba7d09002d44f7e8a.exe 72fe3a6f7ec7918ba7d09002d44f7e8a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

72fe3a6f7ec7918ba7d09002d44f7e8a.exe

description pid process

Token: SeDebugPrivilege 4200 72fe3a6f7ec7918ba7d09002d44f7e8a.exe

description	pid	process	target process
PID 4200 set thread context of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe

description	pid	process
Token: SeDebugPrivilege	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

72fe3a6f7ec7918ba7d09002d44f7e8a.exe

description	pid	process	target process
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe
PID 4200 wrote to memory of 208	4200	72fe3a6f7ec7918ba7d09002d44f7e8a.exe	72fe3a6f7ec7918ba7d09002d44f7e8a.exe

C:\Users\Admin\AppData\Local\Temp\72fe3a6f7ec7918ba7d09002d44f7e8a.exe
C:\Users\Admin\AppData\Local\Temp\72fe3a6f7ec7918ba7d09002d44f7e8a.exe
2⤵
PID:208

memory/208-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/208-139-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/208-140-0x0000000005580000-0x0000000005B98000-memory.dmp

Filesize
6.1MB

Download
memory/208-141-0x0000000004F60000-0x0000000004F72000-memory.dmp

Filesize
72KB

Download
memory/208-142-0x0000000005090000-0x000000000519A000-memory.dmp

Filesize
1.0MB

Download
memory/208-143-0x0000000004F60000-0x0000000005578000-memory.dmp

Filesize
6.1MB

Download
memory/4200-134-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4200-135-0x00000000002C0000-0x000000000033A000-memory.dmp

Filesize
488KB

Download
memory/4200-136-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/4200-137-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download