redline | 96995eadf0555a4f7759c817a64f58810b64a423ab172ac809c373f381d5cd3e

Analysis

Target

redline.exe
Size

569KB
MD5

4842156a83bbc8f5b1b46b0e2a597ab4
SHA1

bdda0f367bf93fa75e2bf4b632daab8b615c9c69
SHA256

24dc9485b3fcea21dc81118d045d6bd13ca40f04dcc905662b70f4ed5754f003
SHA512

f0fe9c63fc8fd1333297b76f7f0ed414535ffb4f8ab96906c8207840bf63688d8b6e0de8053e7882eeb616ddf83c8021d5940adc9fcba4e8fd1e342c67343f73

Score

10^/10

Family

redline

Botnet

KREATOR

45.140.146.214:20498

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral7/memory/1232-136-0x0000000000000000-mapping.dmp	family_redline
behavioral7/memory/1232-137-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 908 set thread context of 1232	908	redline.exe	81

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	redline.exe
Token: SeDebugPrivilege	1232	redline.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81
PID 908 wrote to memory of 1232	908	redline.exe	81

C:\Users\Admin\AppData\Local\Temp\redline.exe
"C:\Users\Admin\AppData\Local\Temp\redline.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Users\Admin\AppData\Local\Temp\redline.exe
  C:\Users\Admin\AppData\Local\Temp\redline.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1232

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redline.exe.log

Filesize
1KB

MD5
1b00c85a0a4b664e6bf7d3def34188ba

SHA1
367e32d38463c96facd684966e9f38462b26b627

SHA256
03a87acc2cdf6ea41b2bbbe71743c8899f594725e7c639e267a1230f4b4163de

SHA512
a2d76028469f842085a282d0da64d9a796a119c53ffc6d408facf09a2114e090a0fe8d63afae321e0c1c06a4550fd880176102f9d0430cb7fcaea9079d16bd85

Download Submit
memory/908-131-0x0000000005640000-0x0000000005BE4000-memory.dmp

Filesize
5.6MB

Download
memory/908-132-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/908-133-0x0000000005000000-0x0000000005076000-memory.dmp

Filesize
472KB

Download
memory/908-134-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/908-135-0x0000000005260000-0x000000000527E000-memory.dmp

Filesize
120KB

Download
memory/908-130-0x00000000005A0000-0x0000000000632000-memory.dmp

Filesize
584KB

Download
memory/1232-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1232-139-0x0000000005520000-0x0000000005B38000-memory.dmp

Filesize
6.1MB

Download
memory/1232-140-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/1232-141-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/1232-142-0x00000000052E0000-0x00000000053EA000-memory.dmp

Filesize
1.0MB

Download