redline | f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6

Analysis

Target

f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe
Size

379KB
MD5

50cfa5c9c5473032df06b4196d59b40f
SHA1

ab4d955f1572a5505402f1ea6c9f0620ca374fbe
SHA256

f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6
SHA512

e0689d3645dbd6eda459b6e39c93a8f06af4741b6bb0557c5856493fa5dc46f9648dc41cda955f6b015ccddaf929816d16a5a67e4c5f331611e07ef08791c5a3

Score

10^/10

Family

redline

Botnet

test1

185.215.113.75:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe

description pid process

Token: SeDebugPrivilege 2584 f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe

description	pid	process
Token: SeDebugPrivilege	2584	f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe

C:\Users\Admin\AppData\Local\Temp\f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe
"C:\Users\Admin\AppData\Local\Temp\f7be66e2c92664c0434b9f443dda17ded3de9bf63a8755f4c1cbf8d9b145e5f6.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

memory/2584-117-0x00000000006E1000-0x000000000070B000-memory.dmp

Filesize
168KB

Download
memory/2584-119-0x00000000020B0000-0x00000000020E7000-memory.dmp

Filesize
220KB

Download
memory/2584-118-0x00000000005B0000-0x00000000006FA000-memory.dmp

Filesize
1.3MB

Download
memory/2584-120-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/2584-121-0x00000000023B0000-0x00000000023E0000-memory.dmp

Filesize
192KB

Download
memory/2584-123-0x0000000004B30000-0x0000000004B5E000-memory.dmp

Filesize
184KB

Download
memory/2584-122-0x0000000004CD0000-0x00000000051CE000-memory.dmp

Filesize
5.0MB

Download
memory/2584-126-0x00000000057E0000-0x00000000058EA000-memory.dmp

Filesize
1.0MB

Download
memory/2584-125-0x0000000004C10000-0x0000000004C22000-memory.dmp

Filesize
72KB

Download
memory/2584-124-0x00000000051D0000-0x00000000057D6000-memory.dmp

Filesize
6.0MB

Download
memory/2584-127-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/2584-128-0x0000000005900000-0x000000000594B000-memory.dmp

Filesize
300KB

Download