redline | 3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
31/10/2022, 01:44

Target

3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe
Size

2.5MB
MD5

1d59f656530b2d362f5d540122fb2d03
SHA1

c6af89f5402210c13ac67d4fc081b015a98c0959
SHA256

3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec
SHA512

5065db582a0de1b319c25c67c40cfaff8a5240b4fc7f0dec9a7d1eac9ffaefef1f6923085a5ebcec07c91e3fdc7ff6e755847dc2e2bb27786477add0d8cf7094
SSDEEP

24576:SxHh9tivm4GY2YlYFBcFuDMGed39+aV0obd3Ve6hGpa3ibCtLHfs25dehl3RuQ5m:Sv9wvmmkJSd3gpuibCtTZdQl3U

Score

10^/10

Family

redline

45.150.108.67:80

Attributes

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/195056-56-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/195056-61-0x000000000041B4EE-mapping.dmp	family_redline
behavioral1/memory/195056-63-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/195056-62-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29
PID 1848 wrote to memory of 195056	1848	3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe	29

C:\Users\Admin\AppData\Local\Temp\3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe
"C:\Users\Admin\AppData\Local\Temp\3a624e7c7d5d4ef86bbf0e40b6e4312104ffb2e8c95c9c9e81999aaa89ca71ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:195056

memory/195056-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195056-56-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195056-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195056-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/195056-64-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download