redline | 1176b04e2fafb75121c0123af0056d080ef97bf98f4fef47ffd7a48d55910db8

General

Target

88600217.exe
Size

4.6MB
MD5

42c773c233daa41deb6cd9aaa3265a1f
SHA1

3178217f4cb7cbd95a6f286717800a8a48bb4fd7
SHA256

1176b04e2fafb75121c0123af0056d080ef97bf98f4fef47ffd7a48d55910db8
SHA512

bae421dc2ba0fb0b99b2f2155e16a575ba3299ef9f341b6110af95dfda8caf6e3c8dc36f182fd14f17adacc59eee160c655244b7e44ace6d9df043b130617071

Score

10^/10

Family

redline

Botnet

@zhilsholi

C2

yabynennet.xyz:81

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1464-66-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/1464-71-0x00000000000A91BA-mapping.dmp	family_redline
behavioral1/memory/1464-72-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline
behavioral1/memory/1464-73-0x0000000000090000-0x00000000000B0000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

88600217.exe

description pid process target process

PID 1616 set thread context of 1464 1616 88600217.exe AppLaunch.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

88600217.exe

pid process

1616 88600217.exe

description	pid	process	target process
PID 1616 set thread context of 1464	1616	88600217.exe	AppLaunch.exe

pid	process
1616	88600217.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

88600217.exe

description	pid	process	target process
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe
PID 1616 wrote to memory of 1464	1616	88600217.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1464

memory/1464-64-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/1464-74-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1464-73-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/1464-72-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/1464-71-0x00000000000A91BA-mapping.dmp

Download
memory/1464-66-0x0000000000090000-0x00000000000B0000-memory.dmp

Filesize
128KB

Download
memory/1616-60-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1616-63-0x0000000000400000-0x000000000093D000-memory.dmp

Filesize
5.2MB

Download
memory/1616-62-0x0000000002190000-0x00000000021F0000-memory.dmp

Filesize
384KB

Download
memory/1616-61-0x0000000000400000-0x000000000093D000-memory.dmp

Filesize
5.2MB

Download
memory/1616-54-0x0000000000400000-0x000000000093D000-memory.dmp

Filesize
5.2MB

Download
memory/1616-58-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/1616-56-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download