redline | c1f4204697908a155a89bd2237d4ded480cfa78afbb555b02ae53a1badd9e8f0

Analysis

Target

setup/AISetup-Crack.exe
Size

346.0MB
MD5

5caa09b3a7089d4ec3ab263af0041826
SHA1

40bafeae4244b17f5bbd42b1863fe8ba83d6e6f3
SHA256

73487ed92e7cc9a0017dc27784a2a48d5d6ede2d76fb3190ab69cdd402d23ab1
SHA512

a49206f66d08b593f0546436e4a83ecebc21d7a8e0a4809075f4ca72513232063b75b4412cd9ebab00e185979e3914c048936de2a37cffa65531a44b8f0eb8e7

Score

10^/10

Family

redline

Botnet

leo5

cenyeyalory.xyz:80

kaiaiannial.xyz:80

viasanainah.xyz:80

xtelstasiup.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1920-57-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1920-62-0x000000000041AE76-mapping.dmp	family_redline
behavioral1/memory/1920-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1920-64-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

AISetup-Crack.exe

description pid process target process

PID 388 set thread context of 1920 388 AISetup-Crack.exe AppLaunch.exe

description	pid	process	target process
PID 388 set thread context of 1920	388	AISetup-Crack.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

AISetup-Crack.exe

description	pid	process	target process
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe
PID 388 wrote to memory of 1920	388	AISetup-Crack.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1920

memory/388-54-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download
memory/1920-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1920-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1920-62-0x000000000041AE76-mapping.dmp

Download
memory/1920-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1920-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download