redline | bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051

General

Target

bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
Size

482KB
MD5

36a1cc43403a58fd1e704fa35a7e4de6
SHA1

b7bcc8e43ab11bdcfae71d91acbd1895e058aea1
SHA256

bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051
SHA512

20c289d5660729bc42db81426075a17379407637f2ea1c81411249a3213d40b8ae38bd9f0f5a85ca62af6bab060b047931af4433b5febc60ba559dd9bc98c5e6

Score

10^/10

redline 1 infostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.14.49.66:35200

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1896-61-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline
behavioral1/memory/1896-62-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline
behavioral1/memory/1896-64-0x0000000000420ADA-mapping.dmp	family_redline
behavioral1/memory/1896-65-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline
behavioral1/memory/1896-70-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline
behavioral1/memory/1896-66-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline
behavioral1/memory/1896-73-0x0000000000080000-0x00000000000A6000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

description	pid	process	target process
PID 1656 set thread context of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exebbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

description	pid	process
Token: SeDebugPrivilege	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
Token: SeDebugPrivilege	1896	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

description	pid	process	target process
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
PID 1656 wrote to memory of 1896	1656	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe	bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe

C:\Users\Admin\AppData\Local\Temp\bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
"C:\Users\Admin\AppData\Local\Temp\bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe
"C:\Users\Admin\AppData\Local\Temp\bbf6333049734115878e6b4be657504e87aa290da228477175963edfdb3a3051.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-54-0x0000000000FA0000-0x000000000101C000-memory.dmp

Filesize
496KB

Download
memory/1656-55-0x00000000004D0000-0x00000000004F0000-memory.dmp

Filesize
128KB

Download
memory/1656-56-0x00000000004F0000-0x0000000000514000-memory.dmp

Filesize
144KB

Download
memory/1656-57-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download
memory/1896-58-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-59-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-61-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-62-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-64-0x0000000000420ADA-mapping.dmp

Download
memory/1896-65-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-70-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-66-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1896-73-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads