redline | a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568

Analysis

max time kernel
4294191s
max time network
150s
platform
windows7_x64
resource
win7-20220310-en
submitted
22/03/2022, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56192025.exe
Size 553KB
Sample220322-x3tkysdfan
SHA256 a8e942ebaff8eb7f4e94c35aa55e48ad6d5791f86a3d1e01ec3a22a9d4bb9568
MD5 8596f6961b0df059be1a2d5317a6e4a4
SHA1 39e41fa9e87d2a6c5036ba8de39dd8ce9bd3c149
SHA512 9cfc6952e9ac41e619842b65a7792fa11955453af6d28c8cf34f5505ed26d67bc3447bfc584b4ddf9ef1f513bd08dd15f2323ace3e2751cda7eb69c00120dc99
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

2.56.56.116:26011

Attributes

auth_value
e159eb8ceab5a5188d392611d13e8a00

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1040-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1040-63-0x000000000041A7BE-mapping.dmp	family_redline
behavioral1/memory/1040-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1040-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 1040	2004	56192025.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28
PID 2004 wrote to memory of 1040	2004	56192025.exe	28

C:\Users\Admin\AppData\Local\Temp\56192025.exe
"C:\Users\Admin\AppData\Local\Temp\56192025.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1040-58-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1040-64-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1040-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1040-66-0x00000000765D1000-0x00000000765D3000-memory.dmp

Download

memory/2004-54-0x0000000000310000-0x0000000000370000-memory.dmp

Download

memory/2004-55-0x00000000031C0000-0x00000000031C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads