redline | 51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4

General

Target

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
Size

1.2MB
MD5

004fe49453b7a12a1087ca4fb0baff26
SHA1

0b8dea5738277fb6eaf7256e69aa28cae5ff17c7
SHA256

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4
SHA512

bd10cf487f6f9bca5fcd9cdbc6ae1f6470842cd5678b6a2b135af000a64c6c12dd32452b666c3bab27002671ff42ad7e2a738a831babddf0593a60a48dd38d55

Score

10^/10

redline hacker infostealer

Malware Config

Extracted

Family

redline

Botnet

Hacker

C2

45.139.236.86:35200

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/364-136-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process	target process
PID 1076 set thread context of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

pid	process
1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process
Token: SeDebugPrivilege	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
Token: SeDebugPrivilege	364	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

description	pid	process	target process
PID 1076 wrote to memory of 4292	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 4292	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 4292	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
PID 1076 wrote to memory of 364	1076	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe	51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe

C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
"C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076

C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
"C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe"
2⤵
PID:4292

C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe
"C:\Users\Admin\AppData\Local\Temp\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\51410421875a08ce24b7cfcdc9f02dee73a42f8da510559fc5ad98011a053ef4.exe.log
Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
memory/364-135-0x0000000000000000-mapping.dmp

Download
memory/364-136-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/364-138-0x0000000005F10000-0x0000000006528000-memory.dmp

Filesize
6.1MB

Download
memory/364-139-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/364-140-0x00000000058A0000-0x00000000058B2000-memory.dmp

Filesize
72KB

Download
memory/364-141-0x0000000005BB0000-0x0000000005CBA000-memory.dmp

Filesize
1.0MB

Download
memory/1076-130-0x0000000000C10000-0x0000000000D48000-memory.dmp

Filesize
1.2MB

Download
memory/1076-131-0x0000000005E90000-0x0000000006434000-memory.dmp

Filesize
5.6MB

Download
memory/1076-132-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/1076-133-0x00000000059A0000-0x00000000059AA000-memory.dmp

Filesize
40KB

Download
memory/4292-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads