redline | 98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3

Analysis

Target

f67bb49bb86906a9ffc771e280f43a85.exe
Size

745KB
MD5

f67bb49bb86906a9ffc771e280f43a85
SHA1

b49ab390436229f854ecf2d7bd87792edb637a46
SHA256

98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3
SHA512

aae8f324775595c24366e12b2822d9f445f2e48da63a974b12d4b35701e98cd84eb88b93818dc4a9f893198b1aa37a978dec89f1b64207f9063b9f564081a3f3

Score

10^/10

Family

redline

Botnet

139.99.32.83:43199

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1384-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

f67bb49bb86906a9ffc771e280f43a85.exe

description pid process target process

PID 4712 set thread context of 1384 4712 f67bb49bb86906a9ffc771e280f43a85.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1240 4712 WerFault.exe f67bb49bb86906a9ffc771e280f43a85.exe

description	pid	process	target process
PID 4712 set thread context of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe

pid	pid_target	process	target process
1240	4712	WerFault.exe	f67bb49bb86906a9ffc771e280f43a85.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f67bb49bb86906a9ffc771e280f43a85.exe

description	pid	process	target process
PID 4712 wrote to memory of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe
PID 4712 wrote to memory of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe
PID 4712 wrote to memory of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe
PID 4712 wrote to memory of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe
PID 4712 wrote to memory of 1384	4712	f67bb49bb86906a9ffc771e280f43a85.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 300
2⤵
- Program crash
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4712 -ip 4712
1⤵
PID:3912

memory/1384-130-0x0000000000000000-mapping.dmp

Download
memory/1384-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1384-136-0x0000000005790000-0x0000000005DA8000-memory.dmp

Filesize
6.1MB

Download
memory/1384-137-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/1384-138-0x0000000005360000-0x000000000546A000-memory.dmp

Filesize
1.0MB

Download
memory/1384-139-0x0000000005290000-0x00000000052CC000-memory.dmp

Filesize
240KB

Download