redline | cc265c5d066b1eb28af641a7676061e145955fbee0e410dc5fdfb8bdb9676695

Analysis

Target

tmp.exe
Size

1.2MB
MD5

455400def1f221f6947098b7f8b744b2
SHA1

e0a33de435792d33be25ee3a667b29b780dfac5e
SHA256

cc265c5d066b1eb28af641a7676061e145955fbee0e410dc5fdfb8bdb9676695
SHA512

6960f5831259c23a3c56b85cbced1512e7063ca313baddb8423ec43a11f9bfc34aeee6e6f57396ca18b84e07c2c21b483c820bc79f0505fd6cd88dd7662f9e3c

Score

10^/10

Family

redline

Botnet

139.99.32.83:43199

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/34876-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/34876-61-0x000000000041AD5A-mapping.dmp	family_redline
behavioral1/memory/34876-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/34876-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 376 set thread context of 34876 376 tmp.exe AppLaunch.exe

description	pid	process	target process
PID 376 set thread context of 34876	376	tmp.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe
PID 376 wrote to memory of 34876	376	tmp.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:34876

memory/34876-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/34876-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/34876-61-0x000000000041AD5A-mapping.dmp

Download
memory/34876-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/34876-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/34876-64-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download