redline | 98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3

Analysis

Target

Setup.exe
Size

745KB
MD5

f67bb49bb86906a9ffc771e280f43a85
SHA1

b49ab390436229f854ecf2d7bd87792edb637a46
SHA256

98c4b88ea63337578782c500fcbf772550ebf2adf11ac28bdec3ff6bc31ff7e3
SHA512

aae8f324775595c24366e12b2822d9f445f2e48da63a974b12d4b35701e98cd84eb88b93818dc4a9f893198b1aa37a978dec89f1b64207f9063b9f564081a3f3

Score

10^/10

Family

redline

Botnet

139.99.32.83:43199

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4080-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 3168 set thread context of 4080 3168 Setup.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4432 3168 WerFault.exe Setup.exe

description	pid	process	target process
PID 3168 set thread context of 4080	3168	Setup.exe	AppLaunch.exe

pid	pid_target	process	target process
4432	3168	WerFault.exe	Setup.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 3168 wrote to memory of 4080	3168	Setup.exe	AppLaunch.exe
PID 3168 wrote to memory of 4080	3168	Setup.exe	AppLaunch.exe
PID 3168 wrote to memory of 4080	3168	Setup.exe	AppLaunch.exe
PID 3168 wrote to memory of 4080	3168	Setup.exe	AppLaunch.exe
PID 3168 wrote to memory of 4080	3168	Setup.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 640
2⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3168 -ip 3168
1⤵
PID:4456

memory/4080-130-0x0000000000000000-mapping.dmp

Download
memory/4080-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4080-136-0x0000000005690000-0x0000000005CA8000-memory.dmp

Filesize
6.1MB

Download
memory/4080-137-0x00000000050B0000-0x00000000050C2000-memory.dmp

Filesize
72KB

Download
memory/4080-138-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/4080-139-0x0000000005110000-0x000000000514C000-memory.dmp

Filesize
240KB

Download