redline | 20eaeb96851593a58cc6fa71ec9181930c8e63be953ee681170b9b6a9dc22500

Analysis

max time kernel
127s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 16:31

Target

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
Size

1.5MB
MD5

0a5188d50679c8e22ba691d632bd8513
SHA1

a099ce72bbc710a3ed4762f92c82a6c2cd1d4018
SHA256

20eaeb96851593a58cc6fa71ec9181930c8e63be953ee681170b9b6a9dc22500
SHA512

0d0af401abca4acd0ed8a2e6e8b5e1e1eb4a632fc558cd4f6b448656f41b5822a42bc94b8b19daff73d2ad5535d0322abc49c17975c9808854bc4c2f56f6a0dd

Score

10^/10

Family

redline

Botnet

6allsupp

jbeaef.ml:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2192-136-0x0000000000400000-0x000000000041C000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process	target process
PID 1300 set thread context of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description pid process

Token: SeDebugPrivilege 2192 20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process
Token: SeDebugPrivilege	2192	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

description	pid	process	target process
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
PID 1300 wrote to memory of 2192	1300	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe	20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe

C:\Users\Admin\AppData\Local\Temp\20EAEB96851593A58CC6FA71EC9181930C8E63BE953EE.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2192

memory/1300-130-0x0000000000C60000-0x0000000000DF0000-memory.dmp

Filesize
1.6MB

Download
memory/1300-131-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/1300-132-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/1300-133-0x0000000005790000-0x000000000579A000-memory.dmp

Filesize
40KB

Download
memory/1300-134-0x00000000090B0000-0x000000000914C000-memory.dmp

Filesize
624KB

Download
memory/2192-135-0x0000000000000000-mapping.dmp

Download
memory/2192-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2192-137-0x0000000005F30000-0x0000000006548000-memory.dmp

Filesize
6.1MB

Download
memory/2192-138-0x0000000005990000-0x00000000059A2000-memory.dmp

Filesize
72KB

Download
memory/2192-139-0x00000000059F0000-0x0000000005A2C000-memory.dmp

Filesize
240KB

Download
memory/2192-140-0x0000000005CA0000-0x0000000005DAA000-memory.dmp

Filesize
1.0MB

Download