redline | 29f9c2e5e05bc0c3f5df610af9fa619974498ad3f9b8b8b359da00ca26c3a4b4

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:01

Target

tmp.exe
Size

1.1MB
MD5

4cc55e311391d1f40219825674315bf2
SHA1

992e42cebf09bdecd7a6fd46e8627b78c5438ff0
SHA256

29f9c2e5e05bc0c3f5df610af9fa619974498ad3f9b8b8b359da00ca26c3a4b4
SHA512

c3f032768f06b72a0996d3ca4b96e8485e96a865f75d90e6ec1a370bf38d76944729c6a036e656af7d61481f676bf9600549ef56942652fd86acc233c2f3e7c3
SSDEEP

12288:Yz81gjoPfaFzhWZVIZ1lxvojGeNtNa8tUpVQkROXnqwoF65O1qEnIa7neK:YYKgyQZVIvlqNR7taRONq9v7eK

Score

10^/10

Family

redline

Botnet

Hacked07/09/2022

171.22.30.129:54686

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/2548-140-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4704 set thread context of 2548	4704	tmp.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4704	tmp.exe
4704	tmp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	tmp.exe
Token: SeDebugPrivilege	2548	tmp.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 1916	4704	tmp.exe	83
PID 4704 wrote to memory of 1916	4704	tmp.exe	83
PID 4704 wrote to memory of 1916	4704	tmp.exe	83
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84
PID 4704 wrote to memory of 2548	4704	tmp.exe	84

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2548

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp.exe.log

Filesize
1KB

MD5
e08f822522c617a40840c62e4b0fb45e

SHA1
ae516dca4da5234be6676d3f234c19ec55725be7

SHA256
bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7

SHA512
894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4

Download Submit
memory/2548-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2548-142-0x0000000005590000-0x0000000005BA8000-memory.dmp

Filesize
6.1MB

Download
memory/2548-143-0x0000000004E80000-0x0000000004E92000-memory.dmp

Filesize
72KB

Download
memory/2548-144-0x0000000004EE0000-0x0000000004F1C000-memory.dmp

Filesize
240KB

Download
memory/2548-145-0x0000000005190000-0x000000000529A000-memory.dmp

Filesize
1.0MB

Download
memory/4704-134-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Filesize
584KB

Download
memory/4704-135-0x0000000004EC0000-0x0000000004ECA000-memory.dmp

Filesize
40KB

Download
memory/4704-136-0x0000000008870000-0x000000000890C000-memory.dmp

Filesize
624KB

Download
memory/4704-137-0x0000000008910000-0x0000000008976000-memory.dmp

Filesize
408KB

Download
memory/4704-132-0x0000000000350000-0x0000000000464000-memory.dmp

Filesize
1.1MB

Download
memory/4704-133-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download