redline | c1f4204697908a155a89bd2237d4ded480cfa78afbb555b02ae53a1badd9e8f0

Analysis

Target

setup/AISetup-Crack.exe
Size

346.0MB
MD5

5caa09b3a7089d4ec3ab263af0041826
SHA1

40bafeae4244b17f5bbd42b1863fe8ba83d6e6f3
SHA256

73487ed92e7cc9a0017dc27784a2a48d5d6ede2d76fb3190ab69cdd402d23ab1
SHA512

a49206f66d08b593f0546436e4a83ecebc21d7a8e0a4809075f4ca72513232063b75b4412cd9ebab00e185979e3914c048936de2a37cffa65531a44b8f0eb8e7

Score

10^/10

Family

redline

Botnet

leo5

cenyeyalory.xyz:80

kaiaiannial.xyz:80

viasanainah.xyz:80

xtelstasiup.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1156-132-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

AISetup-Crack.exe

description pid process target process

PID 3960 set thread context of 1156 3960 AISetup-Crack.exe AppLaunch.exe

description	pid	process	target process
PID 3960 set thread context of 1156	3960	AISetup-Crack.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

AISetup-Crack.exe

description	pid	process	target process
PID 3960 wrote to memory of 1156	3960	AISetup-Crack.exe	AppLaunch.exe
PID 3960 wrote to memory of 1156	3960	AISetup-Crack.exe	AppLaunch.exe
PID 3960 wrote to memory of 1156	3960	AISetup-Crack.exe	AppLaunch.exe
PID 3960 wrote to memory of 1156	3960	AISetup-Crack.exe	AppLaunch.exe
PID 3960 wrote to memory of 1156	3960	AISetup-Crack.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1156

memory/1156-131-0x0000000000000000-mapping.dmp

Download
memory/1156-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1156-137-0x0000000005690000-0x0000000005CA8000-memory.dmp

Filesize
6.1MB

Download
memory/1156-138-0x00000000050F0000-0x0000000005102000-memory.dmp

Filesize
72KB

Download
memory/1156-139-0x0000000005220000-0x000000000532A000-memory.dmp

Filesize
1.0MB

Download
memory/1156-140-0x0000000005150000-0x000000000518C000-memory.dmp

Filesize
240KB

Download
memory/3960-130-0x0000000000583000-0x0000000000585000-memory.dmp

Filesize
8KB

Download