redline | 96995eadf0555a4f7759c817a64f58810b64a423ab172ac809c373f381d5cd3e

Analysis

Target

redline.exe
Size

569KB
MD5

4842156a83bbc8f5b1b46b0e2a597ab4
SHA1

bdda0f367bf93fa75e2bf4b632daab8b615c9c69
SHA256

24dc9485b3fcea21dc81118d045d6bd13ca40f04dcc905662b70f4ed5754f003
SHA512

f0fe9c63fc8fd1333297b76f7f0ed414535ffb4f8ab96906c8207840bf63688d8b6e0de8053e7882eeb616ddf83c8021d5940adc9fcba4e8fd1e342c67343f73

Score

10^/10

Family

redline

Botnet

KREATOR

45.140.146.214:20498

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1232-136-0x0000000000000000-mapping.dmp	family_redline
behavioral7/memory/1232-137-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

redline.exe

description pid process target process

PID 908 set thread context of 1232 908 redline.exe redline.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

redline.exeredline.exe

description pid process

Token: SeDebugPrivilege 908 redline.exe
Token: SeDebugPrivilege 1232 redline.exe

description	pid	process	target process
PID 908 set thread context of 1232	908	redline.exe	redline.exe

description	pid	process
Token: SeDebugPrivilege	908	redline.exe
Token: SeDebugPrivilege	1232	redline.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

redline.exe

description	pid	process	target process
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe
PID 908 wrote to memory of 1232	908	redline.exe	redline.exe

C:\Users\Admin\AppData\Local\Temp\redline.exe
C:\Users\Admin\AppData\Local\Temp\redline.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redline.exe.log
Filesize
1KB

MD5
1b00c85a0a4b664e6bf7d3def34188ba

SHA1
367e32d38463c96facd684966e9f38462b26b627

SHA256
03a87acc2cdf6ea41b2bbbe71743c8899f594725e7c639e267a1230f4b4163de

SHA512
a2d76028469f842085a282d0da64d9a796a119c53ffc6d408facf09a2114e090a0fe8d63afae321e0c1c06a4550fd880176102f9d0430cb7fcaea9079d16bd85

Download Submit
memory/908-131-0x0000000005640000-0x0000000005BE4000-memory.dmp

Filesize
5.6MB

Download
memory/908-132-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/908-133-0x0000000005000000-0x0000000005076000-memory.dmp

Filesize
472KB

Download
memory/908-134-0x0000000005130000-0x000000000513A000-memory.dmp

Filesize
40KB

Download
memory/908-135-0x0000000005260000-0x000000000527E000-memory.dmp

Filesize
120KB

Download
memory/908-130-0x00000000005A0000-0x0000000000632000-memory.dmp

Filesize
584KB

Download
memory/1232-136-0x0000000000000000-mapping.dmp

Download
memory/1232-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1232-139-0x0000000005520000-0x0000000005B38000-memory.dmp

Filesize
6.1MB

Download
memory/1232-140-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Filesize
72KB

Download
memory/1232-141-0x0000000005020000-0x000000000505C000-memory.dmp

Filesize
240KB

Download
memory/1232-142-0x00000000052E0000-0x00000000053EA000-memory.dmp

Filesize
1.0MB

Download