redline | 79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f

Analysis

max time kernel
296s
max time network
299s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
02-10-2022 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
Size

462KB
MD5

22efd9ebef79f6cb0819ea6bf30e72dd
SHA1

1ad43af63f7905787e799a49f67fdc6364961747
SHA256

79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f
SHA512

10cfb6cf28a5c780ab81be5dc0c3398c6bbbe8b70b8cbf72ba0895ef5c4636902a696caead1c30b9d4bafaa98c097f73974819e2abacda0debfe38a8e84cba44
SSDEEP

6144:hEKTXHzlzI2jrvCAxc0Q/pUupBKTuRgM71yFAA141rHn/cOttumgWWZKLgVEV3pS:HZrvgwcCI1+AZ1rFxSQsVEV3pRM

Score

10^/10

redline infostealer

Malware Config

Extracted

Family

redline

80.66.87.22:80

Attributes

auth_value
41a6a625b18cc9db34df665792120c7a

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3244-173-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/3244-174-0x00000000004220FA-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

description	pid	process	target process
PID 2692 set thread context of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

description pid process

Token: SeDebugPrivilege 3244 79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

description	pid	process
Token: SeDebugPrivilege	3244	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

description	pid	process	target process
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
PID 2692 wrote to memory of 3244	2692	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe	79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe

C:\Users\Admin\AppData\Local\Temp\79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
"C:\Users\Admin\AppData\Local\Temp\79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692

C:\Users\Admin\AppData\Local\Temp\79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
C:\Users\Admin\AppData\Local\Temp\79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\79830d1eff53da3fec0f8867806957b8492129715fc0203b40ba139150c1964f.exe.log
Filesize
789B

MD5
db5ef8d7c51bad129d9097bf953e4913

SHA1
8439db960aa2d431bf5ec3c37af775b45eb07e06

SHA256
1248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9

SHA512
04572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee

Download Submit
memory/2692-115-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-116-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-117-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-118-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-119-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-120-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-121-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-122-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-123-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-124-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-125-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-126-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-127-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-128-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-129-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-130-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-131-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-132-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-133-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-134-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-135-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-136-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-137-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-138-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-140-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-139-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-141-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-142-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-143-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-144-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-145-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-146-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-147-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-148-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-149-0x00000000004D0000-0x000000000054A000-memory.dmp

Filesize
488KB

Download
memory/2692-150-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-151-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-152-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-153-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-154-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-155-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-156-0x00000000071B0000-0x00000000072D0000-memory.dmp

Filesize
1.1MB

Download
memory/2692-157-0x00000000077D0000-0x0000000007CCE000-memory.dmp

Filesize
5.0MB

Download
memory/2692-158-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-159-0x00000000073B0000-0x0000000007442000-memory.dmp

Filesize
584KB

Download
memory/2692-160-0x0000000004D10000-0x0000000004D16000-memory.dmp

Filesize
24KB

Download
memory/2692-161-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-162-0x0000000007650000-0x00000000076C6000-memory.dmp

Filesize
472KB

Download
memory/2692-163-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-164-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-165-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-166-0x0000000007350000-0x000000000736E000-memory.dmp

Filesize
120KB

Download
memory/2692-167-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-168-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-169-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-170-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-171-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-172-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/2692-178-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-173-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3244-174-0x00000000004220FA-mapping.dmp

Download
memory/3244-175-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-176-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-179-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-180-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-177-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-181-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-182-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-183-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-184-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-186-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-185-0x0000000077C70000-0x0000000077DFE000-memory.dmp

Filesize
1.6MB

Download
memory/3244-228-0x0000000005600000-0x0000000005C06000-memory.dmp

Filesize
6.0MB

Download
memory/3244-229-0x0000000005190000-0x000000000529A000-memory.dmp

Filesize
1.0MB

Download
memory/3244-231-0x00000000050C0000-0x00000000050D2000-memory.dmp

Filesize
72KB

Download
memory/3244-233-0x0000000005120000-0x000000000515E000-memory.dmp

Filesize
248KB

Download
memory/3244-235-0x00000000052A0000-0x00000000052EB000-memory.dmp

Filesize
300KB

Download
memory/3244-263-0x0000000006600000-0x0000000006666000-memory.dmp

Filesize
408KB

Download