redline | 93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654

Analysis

max time kernel
131s
max time network
145s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
29-09-2022 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
Size

702KB
MD5

6d1eb524b582cadf213416c475be3912
SHA1

9e15d204835b2018e0748547f1d3fbaadd85e1bc
SHA256

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654
SHA512

f7fe994ea76b2bad614ae31183d9ae783b1317728e5902d87bd3a35afc5f0533f576ca18c30fcdc9121bfd3c20218270332b7db306622af6cbf7d3424b650a84
SSDEEP

12288:6Ab2iNIJUoZg6fm02RR3KKfsBE61G3lBEYZIka:f1CJtZvfm0IRzseF3PPZk

Score

10^/10

redline sirus infostealer

Malware Config

Extracted

Family

redline

Botnet

sirus

147.124.223.126:4444

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2952-193-0x000000000041933E-mapping.dmp	family_redline
behavioral1/memory/2952-192-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

description	pid	process	target process
PID 2692 set thread context of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

description pid process

Token: SeDebugPrivilege 2952 93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

description	pid	process
Token: SeDebugPrivilege	2952	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

description	pid	process	target process
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
PID 2692 wrote to memory of 2952	2692	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe	93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe

C:\Users\Admin\AppData\Local\Temp\93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
"C:\Users\Admin\AppData\Local\Temp\93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe
"C:\Users\Admin\AppData\Local\Temp\93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654.exe.log
Filesize
1KB

MD5
12557ab909651a6f99d3503d614d3562

SHA1
b86745768059a514bea3a438e1e96086af463246

SHA256
9589c869703e95d40d5870c60f66d8460f7914e9fe8dd579533c84148112babd

SHA512
10cdb2fa7cf054af937b4aeddfe16fe755d6b09db5a51f7052adbf472b4b435e16c141f3712762f3b67f990c3efcfa47659576988e321214c747d6cd98e75521

Download Submit
memory/2692-119-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-120-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-121-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-122-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-123-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-124-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-125-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-126-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-127-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-128-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-129-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-130-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-131-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-132-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-133-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-134-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-135-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-136-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-137-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-138-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-139-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-140-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-141-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-142-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-143-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-144-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-145-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-146-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-147-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-148-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-149-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-150-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-151-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-152-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-153-0x0000000000F10000-0x0000000000FC6000-memory.dmp

Filesize
728KB

Download
memory/2692-154-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-155-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-156-0x0000000005CD0000-0x00000000061CE000-memory.dmp

Filesize
5.0MB

Download
memory/2692-157-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-158-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/2692-159-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-160-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-161-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-162-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-163-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-164-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-165-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-166-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-167-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-168-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-169-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-170-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-171-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-172-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-173-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-174-0x0000000005810000-0x000000000581A000-memory.dmp

Filesize
40KB

Download
memory/2692-175-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-176-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-177-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-178-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-179-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-180-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-181-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-182-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-183-0x0000000005A90000-0x0000000005AA4000-memory.dmp

Filesize
80KB

Download
memory/2692-184-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-185-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-186-0x0000000005CC0000-0x0000000005CD4000-memory.dmp

Filesize
80KB

Download
memory/2692-187-0x0000000009130000-0x000000000913C000-memory.dmp

Filesize
48KB

Download
memory/2692-188-0x0000000009280000-0x00000000092F8000-memory.dmp

Filesize
480KB

Download
memory/2692-189-0x00000000093B0000-0x000000000944C000-memory.dmp

Filesize
624KB

Download
memory/2692-190-0x00000000094C0000-0x0000000009526000-memory.dmp

Filesize
408KB

Download
memory/2692-191-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Filesize
120KB

Download
memory/2952-193-0x000000000041933E-mapping.dmp

Download
memory/2952-192-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2952-194-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2952-229-0x0000000005C70000-0x0000000006276000-memory.dmp

Filesize
6.0MB

Download
memory/2952-231-0x0000000005520000-0x0000000005532000-memory.dmp

Filesize
72KB

Download
memory/2952-236-0x0000000005580000-0x00000000055BE000-memory.dmp

Filesize
248KB

Download
memory/2952-246-0x00000000055C0000-0x000000000560B000-memory.dmp

Filesize
300KB

Download
memory/2952-248-0x0000000005830000-0x000000000593A000-memory.dmp

Filesize
1.0MB

Download