redline | 234c66dc304dd9fc71382a6db667adf012235c189b23c849b902b94fb8446e07

Analysis

max time kernel
153s
max time network
127s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 20:26

Target

234c66dc304dd9fc71382a6db667adf012235c189b23c.exe
Size

1.2MB
MD5

610f45e860890aa17b10d76892abf71b
SHA1

5e9ed4e242e469bd1a833880a7cdeb2d34cbc993
SHA256

234c66dc304dd9fc71382a6db667adf012235c189b23c849b902b94fb8446e07
SHA512

ae6efe6dc11a1ff767b87ba64bc9db209514c6ad640d6932218850d7c946cdf26ac8f7adb15ffa573df4ccf2643b01b9806830695561a6fc883f39c441a837be

Score

10^/10

Family

redline

Botnet

top1

pemararslava.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

234c66dc304dd9fc71382a6db667adf012235c189b23c.exe

description pid process target process

PID 1560 set thread context of 164236 1560 234c66dc304dd9fc71382a6db667adf012235c189b23c.exe AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 164236 AppLaunch.exe

description	pid	process	target process
PID 1560 set thread context of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	164236	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

234c66dc304dd9fc71382a6db667adf012235c189b23c.exe

description	pid	process	target process
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe
PID 1560 wrote to memory of 164236	1560	234c66dc304dd9fc71382a6db667adf012235c189b23c.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:164236

memory/164236-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/164236-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/164236-61-0x000000000041817E-mapping.dmp

Download
memory/164236-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/164236-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/164236-64-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download