redline | 4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175

General

Target

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
Size

529KB
MD5

054daf924a5537dea562d6b1bea7ebd7
SHA1

5ca2df89fa45d5fe8544033cad2e5116417761b6
SHA256

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175
SHA512

a118c2a0d4056d611c90d9c16bafde79799afdba01adcf905c8c044facf78ed36e630e6bda8323c23a7331a14cf15a2a3c9226fb3e559e466896123c025b8e25

Score

10^/10

redline fullynew agilenet infostealer

Malware Config

Extracted

Family

redline

Botnet

fullynew

C2

rlmushahel.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1568-58-0x000000000041654E-mapping.dmp	family_redline
behavioral1/memory/1568-57-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1568-60-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1568-62-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1636-56-0x0000000000420000-0x0000000000430000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe

description	pid	process	target process
PID 1636 set thread context of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
Token: SeDebugPrivilege	1568	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe

description	pid	process	target process
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 1636 wrote to memory of 1568	1636	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
"C:\Users\Admin\AppData\Local\Temp\4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-58-0x000000000041654E-mapping.dmp

Download
memory/1568-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1568-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1568-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1636-54-0x0000000000B90000-0x0000000000C1A000-memory.dmp

Filesize
552KB

Download
memory/1636-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1636-56-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads