redline | f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 15:43

Target

f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe
Size

2.6MB
MD5

5714c442b4f06df227149d351cf101a3
SHA1

e5eb07dec8deb4b0e5c4905b71e7e6565908c613
SHA256

f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf
SHA512

5620e79822a6e45fb8bcd40ee98024379fafe4e667f208fb9a57000121ada999155f787a5238cc600f62bdd05841f1da55af87e6686bf63e6a66b883cc43a69f
SSDEEP

24576:vn8L/Ae3wYMY8WAAp+SMyKdrpeCh6WUgkyfojvLolT4l3RuQ55313a:viAeH1hakyfojvs14l3E

Score

10^/10

Family

redline

Botnet

ruzki18

176.113.115.146:9582

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/99948-56-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/99948-61-0x0000000000422136-mapping.dmp	family_redline
behavioral1/memory/99948-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/99948-62-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe

description	pid	process	target process
PID 1680 set thread context of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe

description	pid	process	target process
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe
PID 1680 wrote to memory of 99948	1680	f7dbe640f31f8a9c00c0902580c04664a07d68d8453a3e7142691168c6fdbedf.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:99948

memory/99948-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/99948-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/99948-61-0x0000000000422136-mapping.dmp

Download
memory/99948-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/99948-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/99948-64-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download