redline | 93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654

Analysis

max time kernel
133s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-09-2022 13:52

Target

samuelzx.exe
Size

702KB
MD5

6d1eb524b582cadf213416c475be3912
SHA1

9e15d204835b2018e0748547f1d3fbaadd85e1bc
SHA256

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654
SHA512

f7fe994ea76b2bad614ae31183d9ae783b1317728e5902d87bd3a35afc5f0533f576ca18c30fcdc9121bfd3c20218270332b7db306622af6cbf7d3424b650a84
SSDEEP

12288:6Ab2iNIJUoZg6fm02RR3KKfsBE61G3lBEYZIka:f1CJtZvfm0IRzseF3PPZk

Score

10^/10

Family

redline

Botnet

sirus

147.124.223.126:4444

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1616-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1616-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1616-66-0x000000000041933E-mapping.dmp	family_redline
behavioral1/memory/1616-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1616-68-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1616-70-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

samuelzx.exe

description pid process target process

PID 1800 set thread context of 1616 1800 samuelzx.exe samuelzx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

samuelzx.exe

description pid process

Token: SeDebugPrivilege 1616 samuelzx.exe

description	pid	process	target process
PID 1800 set thread context of 1616	1800	samuelzx.exe	samuelzx.exe

description	pid	process
Token: SeDebugPrivilege	1616	samuelzx.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

samuelzx.exe

description	pid	process	target process
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe
PID 1800 wrote to memory of 1616	1800	samuelzx.exe	samuelzx.exe

C:\Users\Admin\AppData\Local\Temp\samuelzx.exe
"C:\Users\Admin\AppData\Local\Temp\samuelzx.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

memory/1616-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1616-66-0x000000000041933E-mapping.dmp

Download
memory/1616-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1800-55-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1800-54-0x0000000000810000-0x00000000008C6000-memory.dmp

Filesize
728KB

Download
memory/1800-59-0x00000000007B0000-0x00000000007CE000-memory.dmp

Filesize
120KB

Download
memory/1800-58-0x0000000005D00000-0x0000000005D78000-memory.dmp

Filesize
480KB

Download
memory/1800-57-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/1800-56-0x00000000004E0000-0x00000000004F4000-memory.dmp

Filesize
80KB

Download