redline | eb3069a13ee9020b0bf6675bdb70c92e67c5b7eeb17f882df4c7f2629047ff02

Analysis

max time kernel
4294213s
max time network
142s
platform
windows7_x64
resource
win7-20220310-en
submitted
24/03/2022, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98effa147916ddfa55103f6d439fb5c7.exe
Size 614KB
Sample220324-1bw4jsbchm
SHA256 eb3069a13ee9020b0bf6675bdb70c92e67c5b7eeb17f882df4c7f2629047ff02
MD5 98effa147916ddfa55103f6d439fb5c7
SHA1 ab00912087cba47cd55b199234a1a1e1cc43d8cd
SHA512 f7f56ccfa52a271028d75b29d08c4bcaa06b710444c3f6882c89aa119885302a4013f05c82add44057050b4d45b4c5e33bc7566674c6c1e5b2a31e180e43b13e
MD5 SHA1 SHA512

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
5ac602c152cb8163381bbfa626204215

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1776-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1776-63-0x000000000041AE2E-mapping.dmp	family_redline
behavioral1/memory/1776-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1776-65-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29
PID 1548 wrote to memory of 1776	1548	98effa147916ddfa55103f6d439fb5c7.exe	29

C:\Users\Admin\AppData\Local\Temp\98effa147916ddfa55103f6d439fb5c7.exe
"C:\Users\Admin\AppData\Local\Temp\98effa147916ddfa55103f6d439fb5c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-54-0x0000000000380000-0x00000000003E0000-memory.dmp

Download

memory/1548-55-0x0000000003200000-0x0000000003203000-memory.dmp

Download

memory/1776-56-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1776-58-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1776-64-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1776-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1776-66-0x0000000076141000-0x0000000076143000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads