redline | 93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654

Analysis

max time kernel
125s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 09:20

Target

tmp.exe
Size

702KB
MD5

6d1eb524b582cadf213416c475be3912
SHA1

9e15d204835b2018e0748547f1d3fbaadd85e1bc
SHA256

93b41f139523aa5e95c9dac7265837e1b85d25a6dacd959e2c68a10a16d00654
SHA512

f7fe994ea76b2bad614ae31183d9ae783b1317728e5902d87bd3a35afc5f0533f576ca18c30fcdc9121bfd3c20218270332b7db306622af6cbf7d3424b650a84
SSDEEP

12288:6Ab2iNIJUoZg6fm02RR3KKfsBE61G3lBEYZIka:f1CJtZvfm0IRzseF3PPZk

Score

10^/10

Family

redline

Botnet

sirus

147.124.223.126:4444

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1000-64-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1000-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1000-66-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1000-67-0x000000000041933E-mapping.dmp	family_redline
behavioral1/memory/1000-69-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1000-71-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1248 set thread context of 1000 1248 tmp.exe tmp.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

tmp.exe

pid process

1248 tmp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exetmp.exe

description pid process

Token: SeDebugPrivilege 1248 tmp.exe
Token: SeDebugPrivilege 1000 tmp.exe

description	pid	process	target process
PID 1248 set thread context of 1000	1248	tmp.exe	tmp.exe

pid	process
1248	tmp.exe

description	pid	process
Token: SeDebugPrivilege	1248	tmp.exe
Token: SeDebugPrivilege	1000	tmp.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1248 wrote to memory of 880	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 880	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 880	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 880	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe
PID 1248 wrote to memory of 1000	1248	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:880

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000

memory/1000-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-71-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-67-0x000000000041933E-mapping.dmp

Download
memory/1000-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1248-57-0x0000000000720000-0x0000000000734000-memory.dmp

Filesize
80KB

Download
memory/1248-60-0x00000000005C0000-0x00000000005DE000-memory.dmp

Filesize
120KB

Download
memory/1248-59-0x00000000057B0000-0x0000000005828000-memory.dmp

Filesize
480KB

Download
memory/1248-58-0x0000000000740000-0x000000000074C000-memory.dmp

Filesize
48KB

Download
memory/1248-54-0x0000000000300000-0x00000000003B6000-memory.dmp

Filesize
728KB

Download
memory/1248-56-0x00000000004B0000-0x00000000004C4000-memory.dmp

Filesize
80KB

Download
memory/1248-55-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download