redline | 20eaeb96851593a58cc6fa71ec9181930c8e63be953ee681170b9b6a9dc22500

Analysis

max time kernel
45s
max time network
153s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 16:31

Target

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
Size

1.5MB
MD5

0a5188d50679c8e22ba691d632bd8513
SHA1

a099ce72bbc710a3ed4762f92c82a6c2cd1d4018
SHA256

20eaeb96851593a58cc6fa71ec9181930c8e63be953ee681170b9b6a9dc22500
SHA512

0d0af401abca4acd0ed8a2e6e8b5e1e1eb4a632fc558cd4f6b448656f41b5822a42bc94b8b19daff73d2ad5535d0322abc49c17975c9808854bc4c2f56f6a0dd

Score

10^/10

Family

redline

Botnet

6allsupp

jbeaef.ml:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-62-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1968-63-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1968-64-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1968-65-0x0000000000416542-mapping.dmp	family_redline
behavioral1/memory/1968-67-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline
behavioral1/memory/1968-69-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process	target process
PID 852 set thread context of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description pid process

Token: SeDebugPrivilege 1968 20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process
Token: SeDebugPrivilege	1968	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process	target process
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 852 wrote to memory of 1968	852	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

C:\Users\Admin\AppData\Local\Temp\20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

memory/852-54-0x0000000000880000-0x0000000000A10000-memory.dmp

Filesize
1.6MB

Download
memory/852-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/852-56-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/852-57-0x0000000007D30000-0x0000000007DDC000-memory.dmp

Filesize
688KB

Download
memory/852-58-0x0000000007DE0000-0x0000000007E3C000-memory.dmp

Filesize
368KB

Download
memory/1968-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-64-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-65-0x0000000000416542-mapping.dmp

Download
memory/1968-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1968-69-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download