redline | bc7da2ff8fd88b93c62d6318a26c17a9bbc14ee658d2064140f4ccdc869764f0

Analysis

max time kernel
76s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 18:14

Target

a078e93cc24db2b52b41dde722aaa333.exe
Size

217KB
MD5

a078e93cc24db2b52b41dde722aaa333
SHA1

8bc2f863ebdc8334b8cf240fd21a254c754498b6
SHA256

bc7da2ff8fd88b93c62d6318a26c17a9bbc14ee658d2064140f4ccdc869764f0
SHA512

3156512dfe0316d251b19e0d9c643c8377f5ed2c1397ce202665c70e5875b400a2952623d7af0fbda5c4e0de0f9ff9e4a1c9f27f63e5e8524fe45a7bce19c97c
SSDEEP

3072:F9Pz9yUZZ91RI9zIpA4sSBmxShqyXAI5BjzQS8iqI6FFLpRntY8Q233inOHc/i:F9z4w3RIpYxjMP2BjzQS8ij6FjRy8Qp

Score

10^/10

Family

redline

Botnet

Lyla.11.09

185.215.113.216:21921

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
Suspicious use of SetThreadContext 1 IoCs

Processes:

a078e93cc24db2b52b41dde722aaa333.exe

description pid process target process

PID 652 set thread context of 1716 652 a078e93cc24db2b52b41dde722aaa333.exe a078e93cc24db2b52b41dde722aaa333.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3572 1716 WerFault.exe a078e93cc24db2b52b41dde722aaa333.exe

description	pid	process	target process
PID 652 set thread context of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe

pid	pid_target	process	target process
3572	1716	WerFault.exe	a078e93cc24db2b52b41dde722aaa333.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a078e93cc24db2b52b41dde722aaa333.exe

description	pid	process	target process
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe
PID 652 wrote to memory of 1716	652	a078e93cc24db2b52b41dde722aaa333.exe	a078e93cc24db2b52b41dde722aaa333.exe

C:\Users\Admin\AppData\Local\Temp\a078e93cc24db2b52b41dde722aaa333.exe
"C:\Users\Admin\AppData\Local\Temp\a078e93cc24db2b52b41dde722aaa333.exe"
2⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 744
3⤵
- Program crash
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1716 -ip 1716
1⤵
PID:2040

memory/652-132-0x0000000000940000-0x0000000000979000-memory.dmp

Filesize
228KB

Download
memory/1716-133-0x0000000000000000-mapping.dmp

Download
memory/1716-134-0x00000000008A0000-0x00000000008BC000-memory.dmp

Filesize
112KB

Download