redline | 0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0 | Triage

Analysis

max time kernel
36s
max time network
40s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-05-2022 15:13

Sharing

Report Analysis Logs

General

Target

1448-64-0x0000000000280000-0x00000000002A0000-memory.exe
Size

128KB
MD5

45776fba0e7012c618d37a47b8cc259d
SHA1

a5101b2a422a8e66d6ea673e803d9035add3a5ed
SHA256

0e07af6d28efb5c7dc0836ff2bdc27eea35184e0cef6a42a07ccf9954ec02ad0
SHA512

45418e0d76d62631c335069bd7a4f351edc0a6f49227ae32071c1b8a2c2fe2758be7f279e12ed7cb830f2c62c00794980bd856c8ec0002eaf149cedfaf11dba5

Score

10^/10

redline install infostealer

Malware Config

Extracted

Family

redline

Botnet

install

C2

31.41.244.92:6188

Attributes

auth_value
eb23a0ca5a38a3bf1eb16b2f08524f35

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1276-54-0x0000000001270000-0x0000000001290000-memory.dmp	family_redline

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 1276 WerFault.exe 1448-64-0x0000000000280000-0x00000000002A0000-memory.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1448-64-0x0000000000280000-0x00000000002A0000-memory.exe

description	pid	process	target process
PID 1276 wrote to memory of 1664	1276	1448-64-0x0000000000280000-0x00000000002A0000-memory.exe	WerFault.exe
PID 1276 wrote to memory of 1664	1276	1448-64-0x0000000000280000-0x00000000002A0000-memory.exe	WerFault.exe
PID 1276 wrote to memory of 1664	1276	1448-64-0x0000000000280000-0x00000000002A0000-memory.exe	WerFault.exe
PID 1276 wrote to memory of 1664	1276	1448-64-0x0000000000280000-0x00000000002A0000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1448-64-0x0000000000280000-0x00000000002A0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1448-64-0x0000000000280000-0x00000000002A0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 504
2⤵
- Program crash
PID:1664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000001270000-0x0000000001290000-memory.dmp

Filesize
128KB

Download
memory/1664-55-0x0000000000000000-mapping.dmp

Download