redline | 438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08

General

Target

438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
Size

848KB
MD5

b4a63487a982b6bba3284225d89f25d5
SHA1

e8009e282e76f9d31f2761ba073b879ce417fd00
SHA256

438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08
SHA512

bb23f408604bbb41c6be8a04277f384cdd75e17cbe189cb593cb9b841ac23745244747736793e0bceef9b830729a5c2939c232da2c87648132dd79b6bb4618a2

Score

10^/10

redline yt infostealer

Malware Config

Extracted

Family

redline

Botnet

YT

C2

193.38.55.97:35200

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1272-140-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

description	pid	process	target process
PID 1564 set thread context of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

description	pid	process
Token: SeDebugPrivilege	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
Token: SeDebugPrivilege	1272	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

description	pid	process	target process
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
PID 1564 wrote to memory of 1272	1564	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe	438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe

C:\Users\Admin\AppData\Local\Temp\438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
"C:\Users\Admin\AppData\Local\Temp\438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe
"C:\Users\Admin\AppData\Local\Temp\438c9c3167e2eb5d8e3325c1c7b27c8beb881e07e67e52db6e86139146886c08.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-143-0x0000000005130000-0x000000000516C000-memory.dmp

Filesize
240KB

Download
memory/1272-140-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1272-141-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download
memory/1272-142-0x00000000057F0000-0x0000000005E08000-memory.dmp

Filesize
6.1MB

Download
memory/1272-144-0x0000000005110000-0x0000000005122000-memory.dmp

Filesize
72KB

Download
memory/1272-145-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1272-146-0x0000000005420000-0x000000000552A000-memory.dmp

Filesize
1.0MB

Download
memory/1564-135-0x0000000000E00000-0x0000000000ED8000-memory.dmp

Filesize
864KB

Download
memory/1564-136-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1564-137-0x00000000058C0000-0x0000000005936000-memory.dmp

Filesize
472KB

Download
memory/1564-138-0x0000000001600000-0x0000000001601000-memory.dmp

Filesize
4KB

Download
memory/1564-139-0x0000000000FC0000-0x0000000000FDE000-memory.dmp

Filesize
120KB

Download
memory/1564-134-0x00000000745D0000-0x0000000074D80000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads