redline | d42440ec031ef76319b37c05d6e4307410e4796dc7736ca9b04184af56faba21

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/08/2022, 18:35

Target
SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe
Size 188KB
Sample220820-w8bfwsfbhj
SHA256 d42440ec031ef76319b37c05d6e4307410e4796dc7736ca9b04184af56faba21
MD5 9a9433ea54265c64d630cfcdf7368371
SHA1 7a77794137c6cafee166453ccf6add4a5be3be42
SHA512 7011d088515c44f3fbb826209e509b7f023e8b50e5cc1b95835375e6e490a090388d537298634cf127628ef60e376d4a375b7714a6d0ef75b578d6d2a3c4639d
MD5 SHA1 SHA512

Score

10^/10

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/1784-55-0x0000000000270000-0x00000000002A3000-memory.dmp	family_redline

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	1784	WerFault.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 1956	1784	SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe	28
PID 1784 wrote to memory of 1956	1784	SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe	28
PID 1784 wrote to memory of 1956	1784	SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe	28
PID 1784 wrote to memory of 1956	1784	SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.28157.19732.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 88
  2⤵
  - Program crash
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2040

memory/1784-55-0x0000000000270000-0x00000000002A3000-memory.dmp

Download