redline | 71cab0db3c492c830b4af57c7dc479ac75489362c967ae55393a27d00d82043f

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 07:18

Target

Setup.exe
Size

1006KB
MD5

556f8368b0adbf6f4a547eb2af242f93
SHA1

eb2f8e06c0f32ef22b60e439a54c934432d15415
SHA256

71cab0db3c492c830b4af57c7dc479ac75489362c967ae55393a27d00d82043f
SHA512

3cecd063ebf1201859ef2bc23e7d6c4088bcff90214bba9bc14fd5c30f0e364001c10b217f9c5d380c5da4acd185ab11c8a7fe93acbdf4be4c88d3539ebc329b
SSDEEP

12288:OWYCX1zgwrZi970wRp10LhM7QkzIe8XsLTSqGBQ34GgT:OXqVrZv2skH88PEQIJ

Score

10^/10

Family

redline

Botnet

youtube

62.109.7.229:80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5108-141-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

Setup.exe

description pid process target process

PID 1792 set thread context of 5108 1792 Setup.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Setup.exe

pid process

1792 Setup.exe
1792 Setup.exe
1792 Setup.exe
1792 Setup.exe
1792 Setup.exe
1792 Setup.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Setup.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1792 Setup.exe
Token: SeDebugPrivilege 5108 RegSvcs.exe

description	pid	process	target process
PID 1792 set thread context of 5108	1792	Setup.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1792	Setup.exe
Token: SeDebugPrivilege	5108	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 1792 wrote to memory of 2784	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 2784	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 2784	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 3068	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 3068	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 3068	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 4336	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 4336	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 4336	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe
PID 1792 wrote to memory of 5108	1792	Setup.exe	RegSvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

memory/1792-132-0x0000000000CB0000-0x0000000000DB0000-memory.dmp

Filesize
1024KB

Download
memory/1792-133-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/1792-134-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/1792-135-0x0000000005900000-0x000000000590A000-memory.dmp

Filesize
40KB

Download
memory/1792-136-0x0000000009050000-0x00000000090EC000-memory.dmp

Filesize
624KB

Download
memory/2784-137-0x0000000000000000-mapping.dmp

Download
memory/3068-138-0x0000000000000000-mapping.dmp

Download
memory/4336-139-0x0000000000000000-mapping.dmp

Download
memory/5108-140-0x0000000000000000-mapping.dmp

Download
memory/5108-141-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5108-142-0x0000000005110000-0x0000000005186000-memory.dmp

Filesize
472KB

Download
memory/5108-143-0x0000000005630000-0x000000000564E000-memory.dmp

Filesize
120KB

Download
memory/5108-144-0x0000000005E10000-0x0000000006428000-memory.dmp

Filesize
6.1MB

Download
memory/5108-145-0x0000000005880000-0x0000000005892000-memory.dmp

Filesize
72KB

Download
memory/5108-146-0x00000000058E0000-0x000000000591C000-memory.dmp

Filesize
240KB

Download
memory/5108-147-0x0000000005B80000-0x0000000005C8A000-memory.dmp

Filesize
1.0MB

Download