redline | 96995eadf0555a4f7759c817a64f58810b64a423ab172ac809c373f381d5cd3e

Analysis

Target

redline.exe
Size

569KB
MD5

4842156a83bbc8f5b1b46b0e2a597ab4
SHA1

bdda0f367bf93fa75e2bf4b632daab8b615c9c69
SHA256

24dc9485b3fcea21dc81118d045d6bd13ca40f04dcc905662b70f4ed5754f003
SHA512

f0fe9c63fc8fd1333297b76f7f0ed414535ffb4f8ab96906c8207840bf63688d8b6e0de8053e7882eeb616ddf83c8021d5940adc9fcba4e8fd1e342c67343f73

Score

10^/10

Family

redline

Botnet

KREATOR

45.140.146.214:20498

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral6/memory/1384-58-0x000000000041638E-mapping.dmp	family_redline
behavioral6/memory/1384-57-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral6/memory/1384-60-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral6/memory/1384-62-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1384	1992	redline.exe	27

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	redline.exe
Token: SeDebugPrivilege	1384	redline.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27
PID 1992 wrote to memory of 1384	1992	redline.exe	27

C:\Users\Admin\AppData\Local\Temp\redline.exe
"C:\Users\Admin\AppData\Local\Temp\redline.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\redline.exe
  C:\Users\Admin\AppData\Local\Temp\redline.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384

memory/1384-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1384-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1384-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1992-54-0x00000000011C0000-0x0000000001252000-memory.dmp

Filesize
584KB

Download
memory/1992-55-0x0000000074E91000-0x0000000074E93000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download