redline | 98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3

Analysis

Target

tmp.exe
Size

745KB
MD5

f67bb49bb86906a9ffc771e280f43a85
SHA1

b49ab390436229f854ecf2d7bd87792edb637a46
SHA256

98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3
SHA512

aae8f324775595c24366e12b2822d9f445f2e48da63a974b12d4b35701e98cd84eb88b93818dc4a9f893198b1aa37a978dec89f1b64207f9063b9f564081a3f3

Score

10^/10

Family

redline

Botnet

139.99.32.83:43199

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2540-131-0x0000000000470000-0x0000000000490000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 2140 set thread context of 2540 2140 tmp.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 2140 WerFault.exe tmp.exe

description	pid	process	target process
PID 2140 set thread context of 2540	2140	tmp.exe	AppLaunch.exe

pid	pid_target	process	target process
1620	2140	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 2140 wrote to memory of 2540	2140	tmp.exe	AppLaunch.exe
PID 2140 wrote to memory of 2540	2140	tmp.exe	AppLaunch.exe
PID 2140 wrote to memory of 2540	2140	tmp.exe	AppLaunch.exe
PID 2140 wrote to memory of 2540	2140	tmp.exe	AppLaunch.exe
PID 2140 wrote to memory of 2540	2140	tmp.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 276
2⤵
- Program crash
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2140 -ip 2140
1⤵
PID:1224

memory/2540-130-0x0000000000000000-mapping.dmp

Download
memory/2540-131-0x0000000000470000-0x0000000000490000-memory.dmp

Filesize
128KB

Download
memory/2540-136-0x0000000005080000-0x0000000005698000-memory.dmp

Filesize
6.1MB

Download
memory/2540-137-0x0000000004B20000-0x0000000004B32000-memory.dmp

Filesize
72KB

Download
memory/2540-138-0x0000000004C50000-0x0000000004D5A000-memory.dmp

Filesize
1.0MB

Download
memory/2540-139-0x0000000004BB0000-0x0000000004BEC000-memory.dmp

Filesize
240KB

Download