redline | bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be

Analysis

Target

bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe
Size

295KB
MD5

d5a4071b7a2b6f45c5178f636bfa1b93
SHA1

89f57ed6b2659e21bdc10c4e7d80efb339d13b3a
SHA256

bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be
SHA512

35d5e7f58fef352d1ed74fbd22fb4da226e0fbc46324ecc34475bd0ee16ce8ab006d165e52d5444c77f4f14abd6a724dcf121dba47e1db9ccf94360394db9e66

Score

10^/10

Family

redline

Botnet

89.22.227.236:22009

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/868-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe

description	pid	process	target process
PID 2896 set thread context of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4624 2896 WerFault.exe bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe

pid	pid_target	process	target process
4624	2896	WerFault.exe	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe

description	pid	process	target process
PID 2896 wrote to memory of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe
PID 2896 wrote to memory of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe
PID 2896 wrote to memory of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe
PID 2896 wrote to memory of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe
PID 2896 wrote to memory of 868	2896	bd7bdf1fe2307d49c71109ee8a7759b1919bccf1f0e6ee3daa76cf3834d7e3be.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 404
2⤵
- Program crash
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2896 -ip 2896
1⤵
PID:2820

memory/868-130-0x0000000000000000-mapping.dmp

Download
memory/868-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/868-136-0x0000000005530000-0x0000000005B48000-memory.dmp

Filesize
6.1MB

Download
memory/868-137-0x0000000004FD0000-0x0000000004FE2000-memory.dmp

Filesize
72KB

Download
memory/868-138-0x0000000005100000-0x000000000520A000-memory.dmp

Filesize
1.0MB

Download
memory/868-139-0x0000000005030000-0x000000000506C000-memory.dmp

Filesize
240KB

Download