redline | 23cfd8c9a0984ddedc9c97cb9effaf1998bb44110a4c490924109a2f0bbbda02

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
08-09-2022 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1005KB
MD5

e150f91742838997639edd06a1c44ebc
SHA1

08277d382d8cedc9a56abd6feca7a58f866b6519
SHA256

23cfd8c9a0984ddedc9c97cb9effaf1998bb44110a4c490924109a2f0bbbda02
SHA512

d2cce7fe2130026dd2a53f74c06b1d37700928ed6ba91ff501fff0910f5861760822fb1b2a24e1e4fa5ce213772a09486482280b3fb97ebb20b6437611f37bb6
SSDEEP

24576:WU60uXt7oSXjDIfhjJFLLXv2wddwSFa0srUSNb:WUO7lPSRLLXOwoSw5rUqb

Score

10^/10

redline 0809_0x00 infostealer

Malware Config

Extracted

Family

redline

Botnet

0809_0x00

ns3.livelogs.xyz:81

Attributes

auth_value
4732d4c9e02e87fffadfade3615428cf

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1992-61-0x00000000000C0000-0x00000000000E8000-memory.dmp	family_redline
behavioral1/memory/1992-62-0x00000000000C0000-0x00000000000E8000-memory.dmp	family_redline
behavioral1/memory/1992-64-0x000000000042213A-mapping.dmp	family_redline
behavioral1/memory/1992-65-0x00000000000C0000-0x00000000000E8000-memory.dmp	family_redline
behavioral1/memory/1992-66-0x00000000000C0000-0x00000000000E8000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 1992	2024	file.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	file.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27
PID 2024 wrote to memory of 1992	2024	file.exe	27

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-58-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1992-59-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1992-61-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1992-62-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1992-64-0x000000000042213A-mapping.dmp

Download
memory/1992-65-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1992-66-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/2024-54-0x0000000000220000-0x0000000000322000-memory.dmp

Filesize
1.0MB

Download
memory/2024-55-0x0000000006E60000-0x0000000007018000-memory.dmp

Filesize
1.7MB

Download
memory/2024-56-0x00000000041C0000-0x00000000041C6000-memory.dmp

Filesize
24KB

Download
memory/2024-57-0x00000000006B0000-0x00000000006CC000-memory.dmp

Filesize
112KB

Download