redline | 51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4

General

Target

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
Size

1.2MB
MD5

004fe49453b7a12a1087ca4fb0baff26
SHA1

0b8dea5738277fb6eaf7256e69aa28cae5ff17c7
SHA256

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4
SHA512

bd10cf487f6f9bca5fcd9cdbc6ae1f6470842cd5678b6a2b135af000a64c6c12dd32452b666c3bab27002671ff42ad7e2a738a831babddf0593a60a48dd38d55

Score

10^/10

redline hacker infostealer

Malware Config

Extracted

Family

redline

Botnet

Hacker

C2

45.139.236.86:35200

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1020-60-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1020-61-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1020-63-0x000000000041FACA-mapping.dmp	family_redline
behavioral1/memory/1020-62-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1020-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1020-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process	target process
PID 1500 set thread context of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process
Token: SeDebugPrivilege	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
Token: SeDebugPrivilege	1020	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process	target process
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1500 wrote to memory of 1020	1500	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
"C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
"C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-57-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-63-0x000000000041FACA-mapping.dmp

Download
memory/1020-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1020-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1500-54-0x0000000000DB0000-0x0000000000EE8000-memory.dmp

Filesize
1.2MB

Download
memory/1500-55-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/1500-56-0x0000000000370000-0x000000000038C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads