redline | 4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175

General

Target

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
Size

529KB
MD5

054daf924a5537dea562d6b1bea7ebd7
SHA1

5ca2df89fa45d5fe8544033cad2e5116417761b6
SHA256

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175
SHA512

a118c2a0d4056d611c90d9c16bafde79799afdba01adcf905c8c044facf78ed36e630e6bda8323c23a7331a14cf15a2a3c9226fb3e559e466896123c025b8e25

Score

10^/10

redline fullynew infostealer

Malware Config

Extracted

Family

redline

Botnet

fullynew

C2

rlmushahel.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2876-134-0x0000000000000000-mapping.dmp	family_redline
behavioral2/memory/2876-135-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe

description	pid	process	target process
PID 2840 set thread context of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
Token: SeDebugPrivilege	2876	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe

description	pid	process	target process
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe
PID 2840 wrote to memory of 2876	2840	4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe
"C:\Users\Admin\AppData\Local\Temp\4a136b737d9e08d4d04f661f050447f5a2ef4c2d1834e434f3bcaf2b85526175.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-130-0x00000000007A0000-0x000000000082A000-memory.dmp

Filesize
552KB

Download
memory/2840-131-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/2840-132-0x0000000005910000-0x0000000005EB4000-memory.dmp

Filesize
5.6MB

Download
memory/2840-133-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/2876-134-0x0000000000000000-mapping.dmp

Download
memory/2876-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2876-136-0x0000000005910000-0x0000000005F28000-memory.dmp

Filesize
6.1MB

Download
memory/2876-137-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/2876-138-0x00000000053D0000-0x000000000540C000-memory.dmp

Filesize
240KB

Download
memory/2876-139-0x0000000005690000-0x000000000579A000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads