redline | 71cab0db3c492c830b4af57c7dc479ac75489362c967ae55393a27d00d82043f

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 07:18

Target

Setup.exe
Size

1006KB
MD5

556f8368b0adbf6f4a547eb2af242f93
SHA1

eb2f8e06c0f32ef22b60e439a54c934432d15415
SHA256

71cab0db3c492c830b4af57c7dc479ac75489362c967ae55393a27d00d82043f
SHA512

3cecd063ebf1201859ef2bc23e7d6c4088bcff90214bba9bc14fd5c30f0e364001c10b217f9c5d380c5da4acd185ab11c8a7fe93acbdf4be4c88d3539ebc329b
SSDEEP

12288:OWYCX1zgwrZi970wRp10LhM7QkzIe8XsLTSqGBQ34GgT:OXqVrZv2skH88PEQIJ

Score

10^/10

Family

redline

Botnet

youtube

62.109.7.229:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1496-61-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1496-62-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1496-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1496-64-0x000000000041E1A6-mapping.dmp	family_redline
behavioral1/memory/1496-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/1496-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1964 set thread context of 1496 1964 Setup.exe RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1496 RegSvcs.exe

description	pid	process	target process
PID 1964 set thread context of 1496	1964	Setup.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1496	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe
PID 1964 wrote to memory of 1496	1964	Setup.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496

memory/1496-58-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-59-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-64-0x000000000041E1A6-mapping.dmp

Download
memory/1496-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1496-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1964-55-0x0000000000BC0000-0x0000000000CC0000-memory.dmp

Filesize
1024KB

Download
memory/1964-56-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/1964-57-0x0000000004EC0000-0x0000000004F0C000-memory.dmp

Filesize
304KB

Download