redline | a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2022 05:49

Target

a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
Size

658KB
MD5

f08b26441446f621c046abdbc3f5b456
SHA1

0170db2cddd19df860223fe4bc140bd01c285853
SHA256

a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7
SHA512

2009a8c7d058d98e047439722cd8d0e6485087e314b23aad31f3e1308f6319e9e718f0b4db86976f2f1274ac412b051056e9e05a2f9c27166e7ad91591f65426

Score

10^/10

Family

redline

Botnet

top1

pemararslava.xyz:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe

description	pid	process	target process
PID 3736 set thread context of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe

description	pid	process	target process
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
PID 3736 wrote to memory of 4720	3736	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe	a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe

C:\Users\Admin\AppData\Local\Temp\a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe
"C:\Users\Admin\AppData\Local\Temp\a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe"
2⤵
PID:4720

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a8d125e363c517ed0f9dc1ad4b8e76985ca396d0feda89b40a7142d6086a17f7.exe.log
Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
memory/3736-131-0x0000000000130000-0x00000000001F0000-memory.dmp

Filesize
768KB

Download
memory/4720-132-0x0000000000000000-mapping.dmp

Download
memory/4720-133-0x0000000000730000-0x000000000074E000-memory.dmp

Filesize
120KB

Download
memory/4720-135-0x0000000005110000-0x0000000005728000-memory.dmp

Filesize
6.1MB

Download
memory/4720-136-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

Filesize
72KB

Download
memory/4720-137-0x0000000004CE0000-0x0000000004DEA000-memory.dmp

Filesize
1.0MB

Download
memory/4720-138-0x0000000004C10000-0x0000000004C4C000-memory.dmp

Filesize
240KB

Download